Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1563600
MD5:	719dcf184f232c140a40a69f05ae2ae7
SHA1:	ac1e40daf79114c78ca756f2cfe5619cd2804cc2
SHA256:	5b5856719e14b1dcf6297e51e69b147263a72203e2f7bc5d938ae41f01312270
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Hides threads from debuggers

Performs DNS queries to domains with low reputation

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

file.exe (PID: 5840 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 719DCF184F232C140A40A69F05AE2AE7)

file.exe (PID: 792 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 719DCF184F232C140A40A69F05AE2AE7)

cmd.exe (PID: 5520 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 84.0% probability

Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C511D00 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C511D00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1438 ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C1438
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C513CC0 CRYPTO_malloc,memcpy,	2_2_00007FFB1C513CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C258B CRYPTO_free,CRYPTO_strdup,	2_2_00007FFB1C4C258B
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1348 CRYPTO_zalloc,ERR_put_error,	2_2_00007FFB1C4C1348
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F7CC0 CRYPTO_free,	2_2_00007FFB1C4F7CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C16D1 CRYPTO_zalloc,ERR_put_error,	2_2_00007FFB1C4C16D1
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4DFD40 strncmp,strncmp,strncmp,strncmp,ERR_put_error,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,ERR_put_error,strncmp,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	2_2_00007FFB1C4DFD40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2522 ERR_put_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FFB1C4C2522
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C11B3 EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FFB1C4C11B3
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C11EA CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,CRYPTO_free,	2_2_00007FFB1C4C11EA
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C13FC EVP_MD_CTX_new,EVP_MD_CTX_free,CRYPTO_memcmp,memcpy,memcpy,	2_2_00007FFB1C4C13FC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2185 CONF_parse_list,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C2185
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4DDE80 CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	2_2_00007FFB1C4DDE80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4CDE30 CRYPTO_free,	2_2_00007FFB1C4CDE30
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4D9E20 CRYPTO_free,CRYPTO_strndup,	2_2_00007FFB1C4D9E20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C51DE20 OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,memcmp,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,CRYPTO_memcmp,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C51DE20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C9E50 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C228E CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C4C228E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4CDEE0 CRYPTO_free,	2_2_00007FFB1C4CDEE0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2220 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C4C2220
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4DDF70 COMP_zlib,CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	2_2_00007FFB1C4DDF70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C51FF20 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,	2_2_00007FFB1C51FF20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4D7F50 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C4D7F50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C16F9 CRYPTO_free,	2_2_00007FFB1C4C16F9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4CDFF0 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,	2_2_00007FFB1C4CDFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1DCF CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,OPENSSL_cleanse,OPENSSL_cleanse,EVP_MD_size,	2_2_00007FFB1C4C1DCF
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1956 EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,strncmp,strncmp,strncmp,strncmp,strncmp,	2_2_00007FFB1C4C1956
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C19FB CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	2_2_00007FFB1C4C19FB
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C51C080 CRYPTO_memcmp,	2_2_00007FFB1C51C080
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4DC070 CRYPTO_zalloc,ERR_put_error,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,	2_2_00007FFB1C4DC070
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C511900 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C511900
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4E58B7 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FFB1C4E58B7
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4E78A0 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FFB1C4E78A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C18DE CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FFB1C4C18DE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C129E CRYPTO_THREAD_run_once,	2_2_00007FFB1C4C129E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4FF920 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4FF920
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C20F9 BN_bin2bn,BN_is_zero,CRYPTO_free,CRYPTO_strdup,CRYPTO_clear_free,	2_2_00007FFB1C4C20F9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1974 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C4C1974
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C10F5 EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_new,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,EVP_MD_CTX_free,	2_2_00007FFB1C4C10F5
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F79B0 CRYPTO_free,	2_2_00007FFB1C4F79B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4E1A90 CRYPTO_free,CRYPTO_strdup,	2_2_00007FFB1C4E1A90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F7A20 CRYPTO_free,	2_2_00007FFB1C4F7A20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C13B6 CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C13B6
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C7A50 CRYPTO_free,	2_2_00007FFB1C4C7A50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F3A40 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FFB1C4F3A40
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4DFAF0 CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	2_2_00007FFB1C4DFAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C14FB EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FFB1C4C14FB
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4D7B50 CRYPTO_zalloc,	2_2_00007FFB1C4D7B50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4E3C10 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C4E3C10
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1122 CRYPTO_free,	2_2_00007FFB1C4C1122
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1C8A CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C4C1C8A
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4D5C70 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	2_2_00007FFB1C4D5C70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C20B3 CRYPTO_free,CRYPTO_malloc,memcpy,	2_2_00007FFB1C4C20B3
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1FF0 CRYPTO_free,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C4C1FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C102D CRYPTO_malloc,COMP_expand_block,	2_2_00007FFB1C4C102D
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C50B510 X509_get0_pubkey,CRYPTO_malloc,RAND_bytes,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FFB1C50B510
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1163 EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C1163
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4D74B0 EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_clear_free,	2_2_00007FFB1C4D74B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C5074B0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C5074B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C511590 CRYPTO_malloc,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	2_2_00007FFB1C511590
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C15E6 EVP_MD_CTX_new,X509_get0_pubkey,EVP_PKEY_id,EVP_PKEY_id,EVP_PKEY_id,EVP_PKEY_size,EVP_DigestVerifyInit,CRYPTO_malloc,BUF_reverse,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_MD_CTX_ctrl,EVP_DigestVerify,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	2_2_00007FFB1C4C15E6
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F3540 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	2_2_00007FFB1C4F3540
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C9610 CRYPTO_malloc,ERR_put_error,CRYPTO_free,	2_2_00007FFB1C4C9610
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4E9610 ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_put_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	2_2_00007FFB1C4E9610
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C16F4 CRYPTO_malloc,CRYPTO_THREAD_lock_new,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,ERR_put_error,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	2_2_00007FFB1C4C16F4
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1E10 ERR_put_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FFB1C4C1E10
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C201D EVP_CIPHER_key_length,EVP_CIPHER_iv_length,CRYPTO_malloc,	2_2_00007FFB1C4C201D
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C50D670 CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C50D670
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C205E EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FFB1C4C205E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F7640 CRYPTO_free,	2_2_00007FFB1C4F7640
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1DCA CRYPTO_malloc,CRYPTO_mem_ctrl,OPENSSL_sk_find,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,OPENSSL_sk_push,CRYPTO_mem_ctrl,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,	2_2_00007FFB1C4C1DCA
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4FF6F0 CRYPTO_realloc,	2_2_00007FFB1C4FF6F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C176C CRYPTO_free,CRYPTO_malloc,memcmp,CRYPTO_memdup,	2_2_00007FFB1C4C176C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1235 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FFB1C4C1235
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C10FF CRYPTO_zalloc,ERR_put_error,ERR_put_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_put_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	2_2_00007FFB1C4C10FF
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1A64 CRYPTO_free,	2_2_00007FFB1C4C1A64
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C507740 CRYPTO_free,CRYPTO_strndup,	2_2_00007FFB1C507740
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C23BA CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C4C23BA
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1C94 HMAC_CTX_new,EVP_CIPHER_CTX_new,EVP_sha256,HMAC_Init_ex,EVP_aes_256_cbc,HMAC_size,EVP_CIPHER_CTX_iv_length,HMAC_Update,HMAC_Final,CRYPTO_memcmp,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_CTX_iv_length,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,	2_2_00007FFB1C4C1C94
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F77C0 CRYPTO_free,	2_2_00007FFB1C4F77C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4EF870 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FFB1C4EF870
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C50B890 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,	2_2_00007FFB1C50B890
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F7860 CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4F7860
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C14B5 ERR_put_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	2_2_00007FFB1C4C14B5
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1115 CRYPTO_zalloc,CRYPTO_free,	2_2_00007FFB1C4C1115
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1A87 memcmp,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,memcmp,memcmp,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C1A87
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F3170 CRYPTO_THREAD_write_lock,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,	2_2_00007FFB1C4F3170
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C50B140 CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FFB1C50B140
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C52D120 BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,CRYPTO_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,	2_2_00007FFB1C52D120
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2284 EVP_MD_size,EVP_CIPHER_iv_length,EVP_CIPHER_key_length,CRYPTO_clear_free,CRYPTO_malloc,	2_2_00007FFB1C4C2284
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1A05 CRYPTO_zalloc,memcpy,memcpy,memcpy,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C1A05
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C91D0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C91D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1398 EVP_MD_CTX_new,EVP_PKEY_new,EVP_PKEY_assign,EVP_PKEY_security_bits,DH_free,EVP_PKEY_get0_DH,EVP_PKEY_free,DH_get0_key,EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,EVP_PKEY_size,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FFB1C4C1398
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1433 CRYPTO_free,CRYPTO_strndup,	2_2_00007FFB1C4C1433
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4E5258 CRYPTO_memdup,ERR_put_error,	2_2_00007FFB1C4E5258
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C160E CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FFB1C4C160E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F7240 CRYPTO_free,	2_2_00007FFB1C4F7240
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1069 CRYPTO_free,	2_2_00007FFB1C4C1069
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C194C ERR_put_error,ASN1_item_free,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,ASN1_item_free,	2_2_00007FFB1C4C194C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F72B0 CRYPTO_free,CRYPTO_strdup,CRYPTO_free,	2_2_00007FFB1C4F72B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2293 CRYPTO_memdup,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C2293
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1073 ERR_put_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	2_2_00007FFB1C4C1073
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4E9380 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	2_2_00007FFB1C4E9380
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C192E CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C192E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C52D430 SRP_Calc_u,BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,	2_2_00007FFB1C52D430
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C50AD00 CRYPTO_malloc,EVP_DigestUpdate,EVP_MD_CTX_free,EVP_PKEY_CTX_free,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	2_2_00007FFB1C50AD00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1E24 CRYPTO_malloc,	2_2_00007FFB1C4C1E24
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4DCCB0 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4DCCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C24F5 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FFB1C4C24F5
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C254F BIO_s_file,BIO_new,BIO_ctrl,strncmp,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	2_2_00007FFB1C4C254F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1A4B OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,CRYPTO_memcmp,	2_2_00007FFB1C4C1A4B
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1802 CRYPTO_strdup,	2_2_00007FFB1C4C1802
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1410 CRYPTO_malloc,ERR_put_error,BIO_snprintf,	2_2_00007FFB1C4C1410
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1983 CRYPTO_free,CRYPTO_memdup,memcmp,CRYPTO_memdup,	2_2_00007FFB1C4C1983
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C177B EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key,EVP_sha256,EVP_DigestSignInit,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,_time64,EVP_MD_CTX_free,EVP_PKEY_free,EVP_MD_CTX_free,EVP_PKEY_free,	2_2_00007FFB1C4C177B
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4D6DB7 CRYPTO_free,CRYPTO_strdup,	2_2_00007FFB1C4D6DB7
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C518DC0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FFB1C518DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2478 CRYPTO_malloc,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_put_error,CRYPTO_clear_free,	2_2_00007FFB1C4C2478
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2383 CRYPTO_malloc,	2_2_00007FFB1C4C2383
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C51AE6C CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C51AE6C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4D6E83 CRYPTO_free,CRYPTO_strdup,	2_2_00007FFB1C4D6E83
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4CAEB0 CRYPTO_free,	2_2_00007FFB1C4CAEB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C115E OPENSSL_LH_insert,OPENSSL_LH_retrieve,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FFB1C4C115E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C512FC0 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,	2_2_00007FFB1C512FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C519080 CRYPTO_malloc,EVP_CIPHER_CTX_new,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_iv_length,RAND_bytes,EVP_sha256,EVP_EncryptUpdate,EVP_EncryptFinal,HMAC_Update,HMAC_Final,	2_2_00007FFB1C519080
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1FFF memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,_time64,	2_2_00007FFB1C4C1FFF
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C19EC CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C4C19EC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2464 CRYPTO_malloc,memcpy,	2_2_00007FFB1C4C2464
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4DC8B0 OPENSSL_sk_num,X509_STORE_CTX_new,ERR_put_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_put_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_put_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	2_2_00007FFB1C4DC8B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1FCD CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C1FCD
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C8980 CRYPTO_free,	2_2_00007FFB1C4C8980
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4EC930 CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4EC930
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C508947 CRYPTO_malloc,	2_2_00007FFB1C508947
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C520950 OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,CRYPTO_memcmp,OPENSSL_sk_push,OPENSSL_sk_num,CRYPTO_free,X509_free,OPENSSL_sk_pop_free,OPENSSL_sk_value,X509_get0_pubkey,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,	2_2_00007FFB1C520950
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4DA9F0 CRYPTO_THREAD_run_once,	2_2_00007FFB1C4DA9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C5009E0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C5009E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F8A60 CRYPTO_zalloc,CRYPTO_free,	2_2_00007FFB1C4F8A60
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F4A90 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,memcpy,	2_2_00007FFB1C4F4A90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4ECA20 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	2_2_00007FFB1C4ECA20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C50CB60 EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C50CB60
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1195 CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C1195
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C163B CRYPTO_free,CRYPTO_malloc,	2_2_00007FFB1C4C163B
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C50AB30 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,	2_2_00007FFB1C50AB30
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1479 CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C4C1479
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4ECBE0 ERR_put_error,ERR_put_error,ERR_put_error,EVP_MD_size,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,d2i_X509,X509_get0_pubkey,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_put_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,ERR_put_error,	2_2_00007FFB1C4ECBE0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2306 CRYPTO_memcmp,memchr,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	2_2_00007FFB1C4C2306
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C518BA0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C518BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1078 CRYPTO_free,	2_2_00007FFB1C4C1078
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C500BD0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FFB1C500BD0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C508C82 CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C508C82
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2207 ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,OPENSSL_LH_new,OPENSSL_sk_num,EVP_get_digestbyname,EVP_get_digestbyname,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,RAND_bytes,RAND_priv_bytes,RAND_priv_bytes,RAND_priv_bytes,	2_2_00007FFB1C4C2207
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C189D CRYPTO_malloc,ERR_put_error,	2_2_00007FFB1C4C189D
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4CEC80 EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,	2_2_00007FFB1C4CEC80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1924 BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	2_2_00007FFB1C4C1924
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4DCC50 CRYPTO_get_ex_new_index,	2_2_00007FFB1C4DCC50
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1762 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	2_2_00007FFB1C4C1762
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1F32 CRYPTO_free,CRYPTO_malloc,RAND_bytes,	2_2_00007FFB1C4C1F32
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C84C0 CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,	2_2_00007FFB1C4C84C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C240F CRYPTO_free,BIO_clear_flags,BIO_set_flags,BIO_snprintf,ERR_add_error_data,memcpy,	2_2_00007FFB1C4C240F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1B7C CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FFB1C4C1B7C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C528570 CRYPTO_free,CRYPTO_malloc,ERR_put_error,	2_2_00007FFB1C528570
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1AC3 CRYPTO_malloc,ERR_put_error,CRYPTO_free,	2_2_00007FFB1C4C1AC3
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1C03 CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	2_2_00007FFB1C4C1C03
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4FA680 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FFB1C4FA680
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4F4630 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FFB1C4F4630
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C101E CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C101E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2225 CRYPTO_free,	2_2_00007FFB1C4C2225
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C46B0 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	2_2_00007FFB1C4C46B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1DBB BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_put_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FFB1C4C1DBB
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C5006C0 CRYPTO_memcmp,	2_2_00007FFB1C5006C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C520760 BN_bin2bn,BN_ucmp,BN_is_zero,CRYPTO_free,CRYPTO_strdup,	2_2_00007FFB1C520760
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4EC790 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	2_2_00007FFB1C4EC790
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C132A CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,	2_2_00007FFB1C4C132A
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1BDB EVP_MD_size,RAND_bytes,_time64,CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C4C1BDB
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C214E CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,ENGINE_finish,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FFB1C4C214E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1393 OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_clear_error,OPENSSL_sk_value,X509_get0_pubkey,X509_free,X509_up_ref,X509_free,OPENSSL_sk_pop_free,	2_2_00007FFB1C4C1393
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C5187F0 CRYPTO_memcmp,	2_2_00007FFB1C5187F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C5127B0 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,	2_2_00007FFB1C5127B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1D5C CRYPTO_clear_free,	2_2_00007FFB1C4C1D5C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2216 CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C2216
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C21BC _time64,CRYPTO_free,CRYPTO_malloc,EVP_sha256,EVP_Digest,EVP_MD_size,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C4C21BC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4D60B8 CRYPTO_free,CRYPTO_strdup,	2_2_00007FFB1C4D60B8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C40AA BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	2_2_00007FFB1C4C40AA
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1050 EVP_PKEY_free,BN_num_bits,BN_bn2bin,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FFB1C4C1050
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2365 CRYPTO_free,CRYPTO_malloc,ERR_put_error,memcpy,	2_2_00007FFB1C4C2365
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C500160 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C500160
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4D61F0 CRYPTO_free,	2_2_00007FFB1C4D61F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4FA1E0 CRYPTO_memcmp,	2_2_00007FFB1C4FA1E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4D8210 EVP_PKEY_CTX_new,EVP_PKEY_derive_init,EVP_PKEY_derive_set_peer,EVP_PKEY_derive,CRYPTO_malloc,EVP_PKEY_derive,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FFB1C4D8210
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4DE1B0 CRYPTO_THREAD_run_once,	2_2_00007FFB1C4DE1B0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4E61A0 ERR_put_error,CRYPTO_free,ERR_put_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	2_2_00007FFB1C4E61A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1CB7 CRYPTO_clear_free,	2_2_00007FFB1C4C1CB7
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1523 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FFB1C4C1523
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1FB9 CRYPTO_free,	2_2_00007FFB1C4C1FB9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C520250 EVP_PKEY_get0_RSA,RSA_size,CRYPTO_malloc,RAND_priv_bytes,CRYPTO_free,	2_2_00007FFB1C520250
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4CE220 CRYPTO_malloc,	2_2_00007FFB1C4CE220
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1131 CRYPTO_free,	2_2_00007FFB1C4C1131
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4E2310 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FFB1C4E2310
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C22C0 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	2_2_00007FFB1C4C22C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C50833B CRYPTO_clear_free,	2_2_00007FFB1C50833B
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C15C8 EVP_MD_CTX_new,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_DigestSignFinal,EVP_DigestSign,BUF_reverse,CRYPTO_free,EVP_MD_CTX_free,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FFB1C4C15C8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C510350 CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	2_2_00007FFB1C510350
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1E79 CRYPTO_free,CRYPTO_malloc,	2_2_00007FFB1C4C1E79
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C8410 CRYPTO_zalloc,ERR_put_error,	2_2_00007FFB1C4C8410
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4FA460 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFB1C4FA460
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C135C memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	2_2_00007FFB1C4C135C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1F0F CRYPTO_free,	2_2_00007FFB1C4C1F0F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C4487 CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	2_2_00007FFB1C4C4487
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C500430 CRYPTO_free,CRYPTO_free,	2_2_00007FFB1C500430
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1BC7 CRYPTO_strdup,CRYPTO_free,	2_2_00007FFB1C4C1BC7

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user~1\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info\LICENSE.txt

Jump to behavior

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: file.exe, 00000002.00000002.1362611144.00007FFB0C072000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: file.exe, 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: file.exe, 00000002.00000002.1363861459.00007FFB0C92F000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: file.exe, 00000002.00000002.1366852178.00007FFB1E680000.00000002.00000001.01000000.00000006.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1366219321.00007FFB1DDE3000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: file.exe, 00000002.00000002.1367402779.00007FFB24BDC000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: file.exe, 00000002.00000002.1362914612.00007FFB0C3F3000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: file.exe, 00000002.00000002.1363861459.00007FFB0C92F000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1365748050.00007FFB1D8BC000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1365748050.00007FFB1D8BC000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: file.exe, 00000002.00000002.1367174447.00007FFB22123000.00000002.00000001.01000000.00000009.sdmp, select.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: file.exe, 00000002.00000002.1364228098.00007FFB1C4AC000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: file.exe, 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1366705387.00007FFB1E478000.00000002.00000001.01000000.00000008.sdmp, _socket.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: file.exe, 00000002.00000002.1365293050.00007FFB1D5FD000.00000002.00000001.01000000.00000010.sdmp, _ssl.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: file.exe, 00000000.00000003.1234080142.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1367012434.00007FFB1E851000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1366368337.00007FFB1DDFD000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1366074495.00007FFB1DDD6000.00000002.00000001.01000000.0000000E.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: file.exe, 00000002.00000002.1363861459.00007FFB0C9B1000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: file.exe, 00000002.00000002.1366547615.00007FFB1DE32000.00000002.00000001.01000000.0000000A.sdmp, pyexpat.pyd.0.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A551DAC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF73A551DAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A55C06C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	0_2_00007FF73A55C06C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A551DAC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF73A551DAC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A55C06C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	2_2_00007FF73A55C06C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A551DAC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF73A551DAC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A551DAC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF73A551DAC

Networking

Performs DNS queries to domains with low reputation

Source:

DNS query: script.irisstealer.xyz

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: script.irisstealer.xyz

Source: file.exe, 00000002.00000002.1360903777.00000212F79B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: file.exe, 00000002.00000003.1343558946.00000212F77DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345655050.00000212F77F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352523174.00000212F77FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348269982.00000212F6F97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348741696.00000212F8061000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360745157.00000212F7865000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360527613.00000212F77FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349099158.00000212F7856000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360436781.00000212F77CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344933173.00000212F77CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343536034.00000212F6F87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350040992.00000212F7871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345377415.00000212F783B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360763520.00000212F7871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338285092.00000212F782C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345377415.00000212F7838000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343427526.00000212F783A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F6F84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342735017.00000212F77CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348344171.00000212F8031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: file.exe, 00000002.00000002.1361169878.00000212F7D58000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue23606)
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe, 00000002.00000002.1361169878.00000212F7D58000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cffi.readthedocs.io/en/latest/cdef.html#ffi-cdef-limitations
Source: file.exe, 00000002.00000003.1340047793.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343020918.00000212F70EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339124494.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344203593.00000212F7566000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348842006.00000212F7573000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343297337.00000212F7565000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340917865.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: file.exe, 00000002.00000003.1347447456.00000212F6FAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341017219.00000212F6FA9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F6F84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345734093.00000212F6FAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1254366186.00000212F7481000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339814178.00000212F6FA3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F6FA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1254366186.00000212F74C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342579949.00000212F760B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341764248.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345125778.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342600057.00000212F7622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338891709.00000212F7685000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349163551.00000212F7688000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1351409113.00000212F7628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343116631.00000212F7687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1351927232.00000212F75BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345753055.00000212F75BC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358076475.00000212F6F30000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350106034.00000212F75BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: file.exe, 00000002.00000003.1339124494.00000212F7007000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341474112.00000212F7668000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340256912.00000212F7007000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359735997.00000212F766D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342510859.00000212F7007000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343409561.00000212F7009000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346170179.00000212F700B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341711101.00000212F7007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342579949.00000212F760B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341764248.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345125778.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342600057.00000212F7622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338891709.00000212F7685000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349163551.00000212F7688000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1351409113.00000212F7628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343116631.00000212F7687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl.
Source: file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342579949.00000212F760B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342600057.00000212F7622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1351409113.00000212F7628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl=
Source: file.exe, 00000002.00000003.1341764248.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345125778.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338891709.00000212F7685000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349163551.00000212F7688000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343116631.00000212F7687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crll4zh
Source: file.exe, 00000002.00000003.1350805990.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359201849.00000212F7524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346984206.00000212F7523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: file.exe, 00000002.00000003.1341474112.00000212F7668000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342001551.00000212F766F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349713536.00000212F7672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F765F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: file.exe, 00000002.00000003.1346984206.00000212F7523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: file.exe, 00000002.00000003.1341474112.00000212F7668000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342001551.00000212F766F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349713536.00000212F7672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F765F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: file.exe, 00000002.00000003.1350805990.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359201849.00000212F7524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346984206.00000212F7523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1351927232.00000212F75BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345753055.00000212F75BC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350106034.00000212F75BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: file.exe, 00000002.00000003.1350805990.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359201849.00000212F7524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346984206.00000212F7523000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlG
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.cr
Source: python310.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: file.exe, 00000002.00000003.1343558946.00000212F77DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345655050.00000212F77F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352523174.00000212F77FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348741696.00000212F8061000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360527613.00000212F77FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342735017.00000212F77CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348344171.00000212F8031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: file.exe, 00000002.00000003.1348269982.00000212F6F97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343536034.00000212F6F87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350040992.00000212F7871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360763520.00000212F7871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338285092.00000212F782C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F6F84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338587511.00000212F786C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344899134.00000212F7871000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: file.exe, 00000002.00000002.1360745157.00000212F7865000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349099158.00000212F7856000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345377415.00000212F783B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338285092.00000212F782C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345377415.00000212F7838000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343427526.00000212F783A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: file.exe, 00000002.00000003.1347364697.00000212F77FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345488512.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343558946.00000212F77DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345655050.00000212F77F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349018837.00000212F70E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346984206.00000212F7503000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1361012978.00000212F7C88000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000003.1347467423.00000212F70DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352179371.00000212F76CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342554919.00000212F76C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360065805.00000212F76CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1361367362.00000212F7E00000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340047793.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341204034.00000212F769A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341521751.00000212F76BC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344603170.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339124494.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1361169878.00000212F7D0C000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350805990.00000212F7504000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338891709.00000212F7685000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1361543567.00000212F7F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: file.exe, 00000002.00000002.1361012978.00000212F7C88000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: file.exe, 00000002.00000002.1358795930.00000212F7250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: file.exe, 00000002.00000002.1358795930.00000212F7250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: file.exe, 00000002.00000002.1358795930.00000212F7250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: file.exe, 00000002.00000003.1341864138.00000212F6B3E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339617797.00000212F6B32000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343151203.00000212F6B3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345314704.00000212F6B40000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: file.exe, 00000002.00000003.1341864138.00000212F6B3E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339617797.00000212F6B32000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343151203.00000212F6B3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345314704.00000212F6B40000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: file.exe, 00000002.00000003.1344916818.00000212F712D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352450851.00000212F712E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341864138.00000212F6B3E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339617797.00000212F6B32000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343132946.00000212F712A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343151203.00000212F6B3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342684886.00000212F7127000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338818714.00000212F7124000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: file.exe, 00000002.00000003.1344955658.00000212F7585000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: file.exe, 00000002.00000002.1358076475.00000212F6F30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359455138.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342650566.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341899601.00000212F75EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, 00000002.00000002.1358638767.00000212F7150000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.1357985420.00000212F6E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341474112.00000212F7668000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352042474.00000212F7590000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359735997.00000212F766D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359349740.00000212F7590000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F765F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/#
Source: file.exe, 00000002.00000003.1341474112.00000212F7668000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359735997.00000212F766D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F765F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: file.exe, 00000002.00000003.1343558946.00000212F77DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360498648.00000212F77F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342735017.00000212F77CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://t.iet
Source: file.exe, 00000002.00000003.1341864138.00000212F6B3E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339617797.00000212F6B32000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345857458.00000212F74D4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1347871892.00000212F74E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F74CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/draft-hixie-thewebsocketprotocol-76
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346984206.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350106034.00000212F75BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350215340.00000212F7546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: file.exe, 00000002.00000002.1360903777.00000212F79B0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358638767.00000212F7150000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5234
Source: file.exe, 00000002.00000002.1361169878.00000212F7D58000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.1361169878.00000212F7D48000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: file.exe, 00000002.00000002.1361786160.00000212F8065000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348741696.00000212F8061000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348978434.00000212F8065000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348344171.00000212F8031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: file.exe, 00000002.00000002.1361012978.00000212F7BB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: file.exe, 00000002.00000002.1360903777.00000212F79B0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358638767.00000212F7150000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6455#section-5.2
Source: file.exe, 00000002.00000003.1338285092.00000212F782C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343427526.00000212F783A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359455138.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342650566.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341899601.00000212F75EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358076475.00000212F6F30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341348638.00000212F75C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359455138.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342650566.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341899601.00000212F75EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341348638.00000212F75C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlp
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359408517.00000212F75DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359455138.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342650566.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341899601.00000212F75EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359455138.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359408517.00000212F75DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342650566.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341899601.00000212F75EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: file.exe, 00000002.00000003.1340047793.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358525667.00000212F70F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349893335.00000212F70F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339124494.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340995011.00000212F70F0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340355883.00000212F70EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: file.exe, 00000002.00000002.1358795930.00000212F7250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352210117.00000212F7603000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359526657.00000212F7603000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348137337.00000212F7605000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359526657.00000212F7608000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342870400.00000212F75FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348822997.00000212F7606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: file.exe, 00000002.00000003.1348741696.00000212F8061000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360436781.00000212F77CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344933173.00000212F77CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342735017.00000212F77CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348344171.00000212F8031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: file.exe, 00000002.00000002.1361367362.00000212F7E28000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dabeaz.com/ply)
Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr, _hashlib.pyd.0.dr, python310.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000002.00000002.1359283331.00000212F7575000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341204034.00000212F769A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338891709.00000212F7685000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344203593.00000212F7566000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348842006.00000212F7573000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343297337.00000212F7565000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359911318.00000212F76A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F7687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: file.exe, 00000002.00000003.1339617797.00000212F6B87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341984926.00000212F6C02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339250188.00000212F6B86000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341394768.00000212F6BA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341937070.00000212F6BC7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342173826.00000212F6C04000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345857458.00000212F7481000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341565634.00000212F6BBC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1351184985.00000212F74A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359035153.00000212F74A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340126815.00000212F6BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: file.exe, 00000002.00000003.1339124494.00000212F7007000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340256912.00000212F7007000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342510859.00000212F7007000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343409561.00000212F7009000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346170179.00000212F700B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341711101.00000212F7007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: file.exe, 00000002.00000003.1341474112.00000212F7668000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F765F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: file.exe, 00000002.00000003.1339124494.00000212F7007000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340256912.00000212F7007000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342510859.00000212F7007000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343409561.00000212F7009000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346170179.00000212F700B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341711101.00000212F7007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cpsU
Source: file.exe, 00000002.00000003.1338285092.00000212F782C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343427526.00000212F783A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: file.exe, 00000002.00000003.1349099158.00000212F7856000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345377415.00000212F783B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338285092.00000212F782C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343427526.00000212F783A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350040992.00000212F786A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: file.exe, 00000002.00000003.1338939774.00000212F6F5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342617575.00000212F6F5C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F6F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: METADATA.0.dr	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: file.exe, 00000002.00000002.1364951917.00007FFB1D4EB000.00000002.00000001.01000000.00000018.sdmp, _cffi_backend.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: METADATA.0.dr	String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: METADATA.0.dr	String found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: file.exe, 00000002.00000002.1360826026.00000212F7880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: file.exe, 00000002.00000002.1358795930.00000212F7250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345753055.00000212F75BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: file.exe, 00000002.00000003.1347795352.00000212F4B28000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341682220.00000212F4B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343058327.00000212F4B1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340208965.00000212F4B47000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339052270.00000212F4B19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1250738588.00000212F4B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342929339.00000212F4B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1356993259.00000212F4B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349351771.00000212F4B54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338839250.00000212F4B15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: METADATA.0.dr	String found in binary or memory: https://github.com/astral-sh/ruff
Source: file.exe, 00000002.00000002.1358795930.00000212F7250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: file.exe, 00000002.00000002.1358890650.00000212F7380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: file.exe, 00000002.00000002.1361012978.00000212F7BB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
Source: file.exe, 00000002.00000002.1358795930.00000212F7250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/pypa/wheel
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/pypa/wheel/issues
Source: file.exe, 00000002.00000002.1357306403.00000212F6868000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: file.exe, 00000002.00000003.1338839250.00000212F4B15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: file.exe, 00000002.00000002.1356887278.00000212F4B2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1347795352.00000212F4B28000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341682220.00000212F4B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343058327.00000212F4B1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340208965.00000212F4B47000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339052270.00000212F4B19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1250738588.00000212F4B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342929339.00000212F4B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1356993259.00000212F4B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349351771.00000212F4B54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338839250.00000212F4B15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: METADATA.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata
Source: METADATA.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: METADATA.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: METADATA.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: file.exe, 00000002.00000002.1356887278.00000212F4B2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1347795352.00000212F4B28000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341682220.00000212F4B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343058327.00000212F4B1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340208965.00000212F4B47000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339052270.00000212F4B19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1250738588.00000212F4B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342929339.00000212F4B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1356993259.00000212F4B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349351771.00000212F4B54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338839250.00000212F4B15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: file.exe, 00000002.00000002.1360826026.00000212F7880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: file.exe, 00000002.00000003.1340047793.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358525667.00000212F70F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349893335.00000212F70F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339124494.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340995011.00000212F70F0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340355883.00000212F70EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: file.exe, 00000002.00000002.1360826026.00000212F7880000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: file.exe, 00000002.00000002.1361012978.00000212F7BB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: file.exe, 00000002.00000003.1341449176.00000212F6F3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339592269.00000212F6F35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352042474.00000212F7590000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340208965.00000212F4B47000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339052270.00000212F4B19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340889830.00000212F4B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352153241.00000212F6F3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344203593.00000212F7566000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348842006.00000212F7573000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343297337.00000212F7565000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1347540051.00000212F4B98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359349740.00000212F7590000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358100388.00000212F6F3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338839250.00000212F4B15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340411397.00000212F4B88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352042474.00000212F7590000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344203593.00000212F7566000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348842006.00000212F7573000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343297337.00000212F7565000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359349740.00000212F7590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: file.exe, 00000002.00000003.1338839250.00000212F4B15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352042474.00000212F7590000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359349740.00000212F7590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: file.exe, 00000002.00000003.1340411397.00000212F4B88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: file.exe, 00000002.00000003.1350084087.00000212F6F53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F6F84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358200539.00000212F6FA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339814178.00000212F6FA3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F6FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: METADATA.0.dr	String found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: METADATA.0.dr	String found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: METADATA.0.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: METADATA.0.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: file.exe, 00000002.00000003.1339617797.00000212F6B87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339250188.00000212F6B86000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341394768.00000212F6BA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341937070.00000212F6BC7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341565634.00000212F6BBC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340126815.00000212F6BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342100976.00000212F6BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: file.exe, 00000002.00000002.1360903777.00000212F79B0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.1361012978.00000212F7BB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: METADATA.0.dr	String found in binary or memory: https://pypi.org/project/importlib_metadata
Source: METADATA0.0.dr	String found in binary or memory: https://pypi.org/project/setuptools/
Source: file.exe, 00000002.00000002.1362914612.00007FFB0C3F3000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: METADATA.0.dr	String found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: file.exe, 00000002.00000002.1358795930.00000212F7250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341017219.00000212F6FA9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1361169878.00000212F7D0C000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F6F84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339814178.00000212F6FA3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F6FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: file.exe, 00000002.00000002.1361169878.00000212F7D0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.ioP
Source: file.exe, 00000002.00000002.1358638767.00000212F7150000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.1361543567.00000212F7FF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://script.irisstealer.xyz/obtenciondeplaticaxxxxmiakhalifa
Source: file.exe, 00000002.00000003.1339617797.00000212F6B87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1347718660.00000212F6C0C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339250188.00000212F6B86000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1357572612.00000212F6B28000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343193726.00000212F6C0C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340532213.00000212F6C0B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343177140.00000212F6B28000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341918747.00000212F6B27000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340126815.00000212F6BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://script.irisstealer.xyz/obtenciondeplaticaxxxxmiakhalifa)
Source: file.exe, 00000002.00000002.1358638767.00000212F7150000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://script.irisstealer.xyz/obtenciondeplaticaxxxxmiakhalifa6
Source: file.exe, 00000002.00000003.1252973705.00000212F6FB9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252973705.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252804495.00000212F6FAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252889060.00000212F6FAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252756249.00000212F700E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: file.exe, 00000002.00000003.1339617797.00000212F6B32000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252973705.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348415093.00000212F6B39000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252804495.00000212F6FAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252889060.00000212F6FAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252756249.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252951798.00000212F6FBD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252973705.00000212F6FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: file.exe, 00000002.00000002.1357985420.00000212F6E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: file.exe, 00000002.00000003.1252973705.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252804495.00000212F6FAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252889060.00000212F6FAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1253433548.00000212F7020000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252756249.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252951798.00000212F6FBD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252973705.00000212F6FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:
Source: file.exe, 00000002.00000003.1252973705.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252804495.00000212F6FAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252889060.00000212F6FAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1253433548.00000212F7020000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252756249.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252951798.00000212F6FBD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252973705.00000212F6FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:r;Nr
Source: METADATA.0.dr	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: METADATA.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: file.exe, 00000002.00000003.1345488512.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1347467423.00000212F70DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340047793.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344603170.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339124494.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346170179.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340917865.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: file.exe, 00000002.00000003.1348269982.00000212F6F97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343536034.00000212F6F87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350040992.00000212F7871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360763520.00000212F7871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338285092.00000212F782C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F6F84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338587511.00000212F786C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344899134.00000212F7871000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: file.exe, 00000002.00000003.1348741696.00000212F8061000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360436781.00000212F77CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344933173.00000212F77CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342735017.00000212F77CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348344171.00000212F8031000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: file.exe, 00000002.00000003.1341449176.00000212F6F3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339592269.00000212F6F35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340208965.00000212F4B47000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339052270.00000212F4B19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340889830.00000212F4B92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352153241.00000212F6F3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1347540051.00000212F4B98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358100388.00000212F6F3C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338839250.00000212F4B15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340411397.00000212F4B88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: file.exe, 00000002.00000002.1360903777.00000212F79B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: file.exe, 00000002.00000002.1360903777.00000212F79B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: METADATA0.0.dr	String found in binary or memory: https://wheel.readthedocs.io/
Source: METADATA0.0.dr	String found in binary or memory: https://wheel.readthedocs.io/en/stable/news.html
Source: file.exe, 00000002.00000003.1340047793.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358525667.00000212F70F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349893335.00000212F70F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339124494.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340995011.00000212F70F0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1254366186.00000212F7481000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340355883.00000212F70EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1254366186.00000212F74C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: file.exe, 00000002.00000003.1341241515.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343646239.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358152620.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339350526.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: file.exe, 00000002.00000002.1364104603.00007FFB0CA27000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F6F84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358200539.00000212F6FA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339814178.00000212F6FA3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F6FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: file.exe, 00000002.00000003.1339617797.00000212F6B87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339250188.00000212F6B86000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341394768.00000212F6BA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341937070.00000212F6BC7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341565634.00000212F6BBC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340126815.00000212F6BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342100976.00000212F6BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: file.exe, 00000002.00000002.1357985420.00000212F6E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: METADATA0.0.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0427/
Source: file.exe, 00000002.00000002.1357306403.00000212F67E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342579949.00000212F760B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359611815.00000212F7620000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343392266.00000212F761F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344540585.00000212F7620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342579949.00000212F760B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342600057.00000212F7622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1351409113.00000212F7628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342579949.00000212F760B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359611815.00000212F7620000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343392266.00000212F761F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344540585.00000212F7620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/;
Source: file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352042474.00000212F7590000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344203593.00000212F7566000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348842006.00000212F7573000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343297337.00000212F7565000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359349740.00000212F7590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A560010	0_2_00007FF73A560010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A551DAC	0_2_00007FF73A551DAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A5462D0	0_2_00007FF73A5462D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A5602A4	0_2_00007FF73A5602A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A541B80	0_2_00007FF73A541B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A549760	0_2_00007FF73A549760
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A55FF2C	0_2_00007FF73A55FF2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A54E80C	0_2_00007FF73A54E80C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A552BE0	0_2_00007FF73A552BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A5587F4	0_2_00007FF73A5587F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A547FCC	0_2_00007FF73A547FCC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A55B13C	0_2_00007FF73A55B13C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A54A060	0_2_00007FF73A54A060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A55C06C	0_2_00007FF73A55C06C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A563C18	0_2_00007FF73A563C18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A54790D	0_2_00007FF73A54790D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A55E4EC	0_2_00007FF73A55E4EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A55E0C0	0_2_00007FF73A55E0C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A55B13C	0_2_00007FF73A55B13C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A559200	0_2_00007FF73A559200
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A556DE0	0_2_00007FF73A556DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A54E5A4	0_2_00007FF73A54E5A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A554684	0_2_00007FF73A554684
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A560A18	0_2_00007FF73A560A18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A550700	0_2_00007FF73A550700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A5482D8	0_2_00007FF73A5482D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A551DAC	0_2_00007FF73A551DAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A547AA4	0_2_00007FF73A547AA4
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A541B80	2_2_00007FF73A541B80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A549760	2_2_00007FF73A549760
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A55FF2C	2_2_00007FF73A55FF2C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A54E80C	2_2_00007FF73A54E80C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A560010	2_2_00007FF73A560010
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A552BE0	2_2_00007FF73A552BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A5587F4	2_2_00007FF73A5587F4
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A547FCC	2_2_00007FF73A547FCC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A55B13C	2_2_00007FF73A55B13C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A54A060	2_2_00007FF73A54A060
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A55C06C	2_2_00007FF73A55C06C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A563C18	2_2_00007FF73A563C18
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A54790D	2_2_00007FF73A54790D
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A55E4EC	2_2_00007FF73A55E4EC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A55E0C0	2_2_00007FF73A55E0C0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A55B13C	2_2_00007FF73A55B13C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A559200	2_2_00007FF73A559200
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A556DE0	2_2_00007FF73A556DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A54E5A4	2_2_00007FF73A54E5A4
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A551DAC	2_2_00007FF73A551DAC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A554684	2_2_00007FF73A554684
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A560A18	2_2_00007FF73A560A18
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A550700	2_2_00007FF73A550700
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A5482D8	2_2_00007FF73A5482D8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A551DAC	2_2_00007FF73A551DAC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A5462D0	2_2_00007FF73A5462D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A5602A4	2_2_00007FF73A5602A4
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A547AA4	2_2_00007FF73A547AA4
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1997	2_2_00007FFB1C4C1997
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1DCF	2_2_00007FFB1C4C1DCF
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1956	2_2_00007FFB1C4C1956
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4CF8B5	2_2_00007FFB1C4CF8B5
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1451	2_2_00007FFB1C4C1451
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C527B90	2_2_00007FFB1C527B90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C50FC00	2_2_00007FFB1C50FC00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C114F	2_2_00007FFB1C4C114F
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C13F2	2_2_00007FFB1C4C13F2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1C94	2_2_00007FFB1C4C1C94
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1A87	2_2_00007FFB1C4C1A87
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4D11A0	2_2_00007FFB1C4D11A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1398	2_2_00007FFB1C4C1398
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4CB370	2_2_00007FFB1C4CB370
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C168B	2_2_00007FFB1C4C168B
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C15B4	2_2_00007FFB1C4C15B4
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C115E	2_2_00007FFB1C4C115E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C520950	2_2_00007FFB1C520950
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1537	2_2_00007FFB1C4C1537
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C6BA0	2_2_00007FFB1C4C6BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C20AE	2_2_00007FFB1C4C20AE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C1BDB	2_2_00007FFB1C4C1BDB
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C520250	2_2_00007FFB1C520250
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C256D	2_2_00007FFB1C4C256D
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1E673550	2_2_00007FFB1E673550

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFB1C52D7E5 appears 101 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFB1C52D74F appears 216 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FF73A542760 appears 82 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FFB1C4C12EE appears 571 times

Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: _pytransform.dll.0.dr

Static PE information: Number of sections : 11 > 10

Source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1234547537.0000022680367000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1234080142.0000022680367000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs file.exe
Source: file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1234690303.0000022680367000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs file.exe
Source: file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000002.00000002.1364104603.00007FFB0CA27000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs file.exe
Source: file.exe, 00000002.00000002.1363442701.00007FFB0C510000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs file.exe
Source: file.exe, 00000002.00000002.1366765026.00007FFB1E482000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs file.exe
Source: file.exe, 00000002.00000002.1367078697.00007FFB1E857000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs file.exe
Source: file.exe, 00000002.00000002.1366133649.00007FFB1DDDD000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs file.exe
Source: file.exe, 00000002.00000002.1366279966.00007FFB1DDE6000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs file.exe
Source: file.exe, 00000002.00000002.1362670345.00007FFB0C0A3000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs file.exe
Source: file.exe, 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenamelibsslH vs file.exe
Source: file.exe, 00000002.00000002.1365858090.00007FFB1D8C5000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs file.exe
Source: file.exe, 00000002.00000002.1367446603.00007FFB24BE6000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs file.exe
Source: file.exe, 00000002.00000002.1366916098.00007FFB1E68B000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs file.exe
Source: file.exe, 00000002.00000002.1367245754.00007FFB22126000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs file.exe
Source: file.exe, 00000002.00000002.1364465647.00007FFB1C4B1000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs file.exe
Source: file.exe, 00000002.00000002.1365621968.00007FFB1D615000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs file.exe
Source: file.exe, 00000002.00000002.1366608005.00007FFB1DE3D000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs file.exe
Source: file.exe, 00000002.00000002.1366437759.00007FFB1DE02000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs file.exe

Source: classification engine

Classification label: mal52.troj.evad.winEXE@6/77@1/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF73A546FA0 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF73A546FA0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6480:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user~1\AppData\Local\Temp\_MEI58402

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000002.00000002.1362611144.00007FFB0C072000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000002.00000002.1362611144.00007FFB0C072000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000002.00000002.1362611144.00007FFB0C072000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000002.00000002.1362611144.00007FFB0C072000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, 00000002.00000002.1362611144.00007FFB0C072000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000002.00000002.1362611144.00007FFB0C072000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000002.00000002.1362611144.00007FFB0C072000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 23380969 > 1048576

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: file.exe, 00000002.00000002.1362611144.00007FFB0C072000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: file.exe, 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: file.exe, 00000002.00000002.1363861459.00007FFB0C92F000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: file.exe, 00000002.00000002.1366852178.00007FFB1E680000.00000002.00000001.01000000.00000006.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: file.exe, 00000000.00000003.1235671110.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1366219321.00007FFB1DDE3000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: file.exe, 00000002.00000002.1367402779.00007FFB24BDC000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: file.exe, 00000000.00000003.1235165574.0000022680367000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: file.exe, 00000002.00000002.1362914612.00007FFB0C3F3000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: file.exe, 00000002.00000002.1363861459.00007FFB0C92F000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1365748050.00007FFB1D8BC000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: file.exe, 00000000.00000003.1234193539.0000022680367000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: file.exe, 00000000.00000003.1234940270.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1365748050.00007FFB1D8BC000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: file.exe, 00000000.00000003.1235052042.0000022680367000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: file.exe, 00000002.00000002.1367174447.00007FFB22123000.00000002.00000001.01000000.00000009.sdmp, select.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: file.exe, 00000002.00000002.1364228098.00007FFB1C4AC000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: file.exe, 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: file.exe, 00000000.00000003.1235742929.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1366705387.00007FFB1E478000.00000002.00000001.01000000.00000008.sdmp, _socket.pyd.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: file.exe, 00000002.00000002.1365293050.00007FFB1D5FD000.00000002.00000001.01000000.00000010.sdmp, _ssl.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: file.exe, 00000000.00000003.1234080142.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1367012434.00007FFB1E851000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: file.exe, 00000000.00000003.1234293197.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1366368337.00007FFB1DDFD000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: file.exe, 00000000.00000003.1234841877.0000022680367000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1366074495.00007FFB1DDD6000.00000002.00000001.01000000.0000000E.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: file.exe, 00000002.00000002.1363861459.00007FFB0C9B1000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: file.exe, 00000002.00000002.1366547615.00007FFB1DE32000.00000002.00000001.01000000.0000000A.sdmp, pyexpat.pyd.0.dr

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0xEFFF39AD [Sun Aug 4 18:57:49 2097 UTC]

Source: md__mypyc.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x280fa
Source: _MD5.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x12225
Source: _chacha20.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x741f
Source: _SHA1.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xbd05
Source: _scrypt.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x80b5
Source: _raw_blowfish.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x11ec6
Source: _MD2.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x110e3
Source: _raw_cbc.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x3a38
Source: _raw_arc2.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x966e
Source: _raw_ctr.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x46bb
Source: _raw_cast.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x7870
Source: _modexp.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xdf94
Source: _ghash_clmul.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x9c9d
Source: _Salsa20.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x3657
Source: _RIPEMD160.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x6f18
Source: _SHA384.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x100ff
Source: _BLAKE2s.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x50f7
Source: _poly1305.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xbea9
Source: _SHA224.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x13d1f
Source: _cffi_backend.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x3108a
Source: _raw_aes.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x14e8f
Source: _raw_ecb.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x4c1b
Source: _cpuid_c.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xe2b6
Source: _BLAKE2b.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x864f
Source: _raw_aesni.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xd2c3
Source: _raw_ocb.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x14299
Source: _raw_des.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x124f2
Source: _raw_cfb.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x9762
Source: _MD4.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x9fa9
Source: _raw_des3.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x10195
Source: _strxor.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x10aad
Source: _raw_ofb.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0x727a
Source: _ec_ws.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xc5419
Source: _keccak.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xaf1b
Source: _raw_eksblowfish.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xc1e6
Source: _ARC4.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xc8ba
Source: _pytransform.dll.0.dr	Static PE information: real checksum: 0x11edfe should be: 0x11dbef
Source: md.cp310-win_amd64.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xf357
Source: _ghash_portable.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xa111
Source: _SHA512.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xbd08
Source: _SHA256.pyd.0.dr	Static PE information: real checksum: 0x0 should be: 0xa85b

Source: file.exe	Static PE information: section name: _RDATA
Source: _pytransform.dll.0.dr	Static PE information: section name: .xdata
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: python310.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_pytransform.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA1.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user~1\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info\LICENSE.txt

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF73A543C90 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF73A543C90

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_pytransform.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA1.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-15447

Source: C:\Users\user\Desktop\file.exe

API coverage: 2.7 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A551DAC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF73A551DAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A55C06C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	0_2_00007FF73A55C06C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A551DAC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF73A551DAC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A55C06C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	2_2_00007FF73A55C06C
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A551DAC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF73A551DAC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A551DAC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF73A551DAC

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00007FFB1E67F61C GetSystemInfo,VirtualAlloc,

2_2_00007FFB1E67F61C

Source: cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: file.exe	Binary or memory string: jqEMu
Source: file.exe, 00000002.00000003.1264906153.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341241515.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343646239.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358152620.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339350526.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252804495.00000212F6F7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF73A555750 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF73A555750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF73A55DB48 GetProcessHeap,

0_2_00007FF73A55DB48

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A555750 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF73A555750
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A54A8DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF73A54A8DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A54B0C4 SetUnhandledExceptionFilter,	0_2_00007FF73A54B0C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF73A54AEE0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF73A54AEE0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A555750 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF73A555750
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A54A8DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF73A54A8DC
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A54B0C4 SetUnhandledExceptionFilter,	2_2_00007FF73A54B0C4
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FF73A54AEE0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF73A54AEE0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1C4C2004 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFB1C4C2004
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1E675B90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFB1E675B90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00007FFB1E676134 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFB1E676134

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF73A563A60 cpuid

0_2_00007FF73A563A60

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\_pytransform.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\_pytransform.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\_pytransform.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer\md.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\certifi\cacert.pem VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402\_cffi_backend.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI58402 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF73A54ADC8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF73A54ADC8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF73A560010 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF73A560010

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_cffi_backend.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_pytransform.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer\md.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI58402\libffi-7.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
script.irisstealer.xyz	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://requests.readthedocs.ioP	0%	Avira URL Cloud	safe
https://script.irisstealer.xyz/obtenciondeplaticaxxxxmiakhalifa	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:r;Nr	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:	0%	Avira URL Cloud	safe
https://wwww.certigna.fr/autorites/;	0%	Avira URL Cloud	safe
http://t.iet	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:	0%	Virustotal		Browse
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:r;Nr	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
script.irisstealer.xyz	172.67.142.108	true	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:r;Nr	file.exe, 00000002.00000003.1252973705.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252804495.00000212F6FAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252889060.00000212F6FAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1253433548.00000212F7020000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252756249.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252951798.00000212F6FBD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252973705.00000212F6FBE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.dabeaz.com/ply)	file.exe, 00000002.00000002.1361367362.00000212F7E28000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/astral-sh/ruff	METADATA.0.dr	false		high
http://crl.dhimyotis.com/certignarootca.crl.	file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	file.exe, 00000002.00000002.1357985420.00000212F6E30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg	METADATA.0.dr	false		high
https://github.com/python/importlib_metadata	METADATA.0.dr	false		high
https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets	METADATA.0.dr	false		high
https://github.com/python/importlib_metadata/issues	METADATA.0.dr	false		high
http://repository.swisssign.com/0	file.exe, 00000002.00000003.1341474112.00000212F7668000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359735997.00000212F766D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F765F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://python.org/dev/peps/pep-0263/	file.exe, 00000002.00000002.1362914612.00007FFB0C3F3000.00000002.00000001.01000000.00000004.sdmp, python310.dll.0.dr	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	file.exe, 00000002.00000002.1356887278.00000212F4B2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1347795352.00000212F4B28000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341682220.00000212F4B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343058327.00000212F4B1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340208965.00000212F4B47000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339052270.00000212F4B19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1250738588.00000212F4B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342929339.00000212F4B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1356993259.00000212F4B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349351771.00000212F4B54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338839250.00000212F4B15000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wheel.readthedocs.io/en/stable/news.html	METADATA0.0.dr	false		high
http://crl.dhimyotis.com/certignarootca.crl=	file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342579949.00000212F760B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342600057.00000212F7622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1351409113.00000212F7628000.00000004.00000020.00020000.00000000.sdmp	false		high
https://importlib-metadata.readthedocs.io/	METADATA.0.dr	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	file.exe, 00000002.00000003.1345488512.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1347467423.00000212F70DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340047793.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344603170.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339124494.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346170179.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340917865.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	file.exe, 00000002.00000002.1358795930.00000212F7250000.00000004.00001000.00020000.00000000.sdmp	false		high
https://readthedocs.org/projects/importlib-metadata/badge/?version=latest	METADATA.0.dr	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	file.exe, 00000002.00000002.1358795930.00000212F7250000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crll4zh	file.exe, 00000002.00000003.1341764248.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345125778.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338891709.00000212F7685000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349163551.00000212F7688000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343116631.00000212F7687000.00000004.00000020.00020000.00000000.sdmp	false		high
https://requests.readthedocs.ioP	file.exe, 00000002.00000002.1361169878.00000212F7D0C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cffi.readthedocs.io/en/latest/cdef.html#ffi-cdef-limitations	file.exe, 00000002.00000002.1361169878.00000212F7D58000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	file.exe, 00000002.00000002.1360826026.00000212F7880000.00000004.00001000.00020000.00000000.sdmp	false		high
https://blog.jaraco.com/skeleton	METADATA.0.dr	false		high
https://wwww.certigna.fr/autorites/;	file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342579949.00000212F760B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359611815.00000212F7620000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343392266.00000212F761F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344540585.00000212F7620000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc3610	file.exe, 00000002.00000003.1348269982.00000212F6F97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343536034.00000212F6F87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350040992.00000212F7871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360763520.00000212F7871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338285092.00000212F782C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F6F84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338587511.00000212F786C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344899134.00000212F7871000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/platformdirs/platformdirs	file.exe, 00000002.00000002.1358890650.00000212F7380000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342579949.00000212F760B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341764248.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345125778.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342600057.00000212F7622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338891709.00000212F7685000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349163551.00000212F7688000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F7687000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1351409113.00000212F7628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343116631.00000212F7687000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	file.exe, 00000002.00000002.1361012978.00000212F7C88000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.accv.es	file.exe, 00000002.00000002.1358076475.00000212F6F30000.00000004.00000020.00020000.00000000.sdmp	false		high
https://script.irisstealer.xyz/obtenciondeplaticaxxxxmiakhalifa	file.exe, 00000002.00000002.1358638767.00000212F7150000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.1361543567.00000212F7FF0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md	METADATA0.0.dr	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:	file.exe, 00000002.00000003.1252973705.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252804495.00000212F6FAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252889060.00000212F6FAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1253433548.00000212F7020000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252756249.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252951798.00000212F6FBD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252973705.00000212F6FBE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://json.org	file.exe, 00000002.00000003.1344955658.00000212F7585000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	file.exe, 00000002.00000002.1360903777.00000212F79B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	file.exe, 00000002.00000002.1357306403.00000212F6868000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/get	file.exe, 00000002.00000003.1350084087.00000212F6F53000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crlG	file.exe, 00000002.00000003.1350805990.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359201849.00000212F7524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346984206.00000212F7523000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access	file.exe, 00000002.00000003.1339617797.00000212F6B32000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252973705.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348415093.00000212F6B39000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252804495.00000212F6FAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252889060.00000212F6FAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252756249.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252951798.00000212F6FBD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252973705.00000212F6FBE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342579949.00000212F760B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342600057.00000212F7622000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1351409113.00000212F7628000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/wheel	METADATA0.0.dr	false		high
https://www.python.org/dev/peps/pep-0427/	METADATA0.0.dr	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	file.exe, 00000002.00000002.1356887278.00000212F4B2B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1347795352.00000212F4B28000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341682220.00000212F4B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343058327.00000212F4B1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340208965.00000212F4B47000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339052270.00000212F4B19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1250738588.00000212F4B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342929339.00000212F4B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1356993259.00000212F4B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349351771.00000212F4B54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338839250.00000212F4B15000.00000004.00000020.00020000.00000000.sdmp	false		high
http://foo/bar.tgz	file.exe, 00000002.00000002.1358795930.00000212F7250000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/	file.exe, 00000002.00000003.1340411397.00000212F4B88000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/	file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342579949.00000212F760B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359611815.00000212F7620000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343392266.00000212F761F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344540585.00000212F7620000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz	file.exe, 00000002.00000003.1340047793.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358525667.00000212F70F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349893335.00000212F70F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339124494.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340995011.00000212F70F0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1254366186.00000212F7481000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340355883.00000212F70EB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1254366186.00000212F74C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/reference/import.html#finders-and-loaders	METADATA.0.dr	false		high
https://img.shields.io/badge/skeleton-2024-informational	METADATA.0.dr	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	file.exe, 00000002.00000003.1344916818.00000212F712D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352450851.00000212F712E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341864138.00000212F6B3E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339617797.00000212F6B32000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343132946.00000212F712A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343151203.00000212F6B3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342684886.00000212F7127000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338818714.00000212F7124000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	file.exe, 00000002.00000003.1347795352.00000212F4B28000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341682220.00000212F4B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343058327.00000212F4B1A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340208965.00000212F4B47000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339052270.00000212F4B19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1250738588.00000212F4B53000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342929339.00000212F4B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1356993259.00000212F4B55000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349351771.00000212F4B54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338839250.00000212F4B15000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/draft-hixie-thewebsocketprotocol-76	file.exe, 00000002.00000003.1341864138.00000212F6B3E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339617797.00000212F6B32000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345857458.00000212F74D4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1347871892.00000212F74E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F74CC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	file.exe, 00000002.00000003.1346984206.00000212F7523000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wwwsearch.sf.net/):	file.exe, 00000002.00000003.1338939774.00000212F6F5A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342617575.00000212F6F5C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F6F57000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359455138.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342650566.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341899601.00000212F75EC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358076475.00000212F6F30000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm	file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359408517.00000212F75DF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	file.exe, 00000002.00000002.1361012978.00000212F7BB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlp	file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341348638.00000212F75C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cffi.readthedocs.io/en/latest/using.html#callbacks	file.exe, 00000002.00000002.1364951917.00007FFB1D4EB000.00000002.00000001.01000000.00000018.sdmp, _cffi_backend.cp310-win_amd64.pyd.0.dr	false		high
http://crl.xrampsecurity.com/XGCA.crl0	file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1351927232.00000212F75BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345753055.00000212F75BC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350106034.00000212F75BD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc5234	file.exe, 00000002.00000002.1360903777.00000212F79B0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358638767.00000212F7150000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	file.exe, 00000002.00000003.1341602343.00000212F75F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75FA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352210117.00000212F7603000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359526657.00000212F7603000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348137337.00000212F7605000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359526657.00000212F7608000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342870400.00000212F75FF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348822997.00000212F7606000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/pkg_resources.html	file.exe, 00000002.00000003.1252973705.00000212F6FB9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252973705.00000212F700E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252804495.00000212F6FAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252889060.00000212F6FAE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1252756249.00000212F700E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352042474.00000212F7590000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344203593.00000212F7566000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348842006.00000212F7573000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343297337.00000212F7565000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359349740.00000212F7590000.00000004.00000020.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/v/importlib_metadata.svg	METADATA.0.dr	false		high
https://packaging.python.org/specifications/entry-points/	file.exe, 00000002.00000002.1360903777.00000212F79B0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000002.00000002.1361012978.00000212F7BB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://t.iet	file.exe, 00000002.00000003.1343558946.00000212F77DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360498648.00000212F77F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342735017.00000212F77CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/jaraco/jaraco.functools/issues/5	file.exe, 00000002.00000002.1358795930.00000212F7250000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es00	file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341279235.00000212F75D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359455138.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359408517.00000212F75DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342650566.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341899601.00000212F75EC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	file.exe, 00000002.00000003.1338839250.00000212F4B15000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.rfc-editor.org/info/rfc7253	file.exe, 00000002.00000003.1338285092.00000212F782C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343427526.00000212F783A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue23606)	file.exe, 00000002.00000002.1361169878.00000212F7D58000.00000004.00001000.00020000.00000000.sdmp	false		high
http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf	file.exe, 00000002.00000003.1348269982.00000212F6F97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343536034.00000212F6F87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350040992.00000212F7871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360763520.00000212F7871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338285092.00000212F782C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F6F84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338587511.00000212F786C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344899134.00000212F7871000.00000004.00000020.00020000.00000000.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	file.exe, 00000002.00000002.1360826026.00000212F7880000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	file.exe, 00000002.00000003.1340047793.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358525667.00000212F70F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349893335.00000212F70F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339124494.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340995011.00000212F70F0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F70BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340355883.00000212F70EB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	file.exe, 00000002.00000003.1341864138.00000212F6B3E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339617797.00000212F6B32000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343151203.00000212F6B3F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345314704.00000212F6B40000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	file.exe, 00000002.00000003.1339617797.00000212F6B87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339250188.00000212F6B86000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341394768.00000212F6BA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341937070.00000212F6BC7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341565634.00000212F6BBC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340126815.00000212F6BA0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342100976.00000212F6BF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl	file.exe, 00000002.00000003.1350805990.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359201849.00000212F7524000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346984206.00000212F7523000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.../back.jpeg	file.exe, 00000002.00000002.1360903777.00000212F79B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc5869	file.exe, 00000002.00000002.1361786160.00000212F8065000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348741696.00000212F8061000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348978434.00000212F8065000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348344171.00000212F8031000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/download/releases/2.3/mro/.	file.exe, 00000002.00000002.1357306403.00000212F67E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html	file.exe, 00000002.00000003.1343558946.00000212F77DF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345655050.00000212F77F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352523174.00000212F77FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348269982.00000212F6F97000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348741696.00000212F8061000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360745157.00000212F7865000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360527613.00000212F77FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349099158.00000212F7856000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360436781.00000212F77CC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344933173.00000212F77CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343536034.00000212F6F87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1350040992.00000212F7871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345377415.00000212F783B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1360763520.00000212F7871000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338285092.00000212F782C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345377415.00000212F7838000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343427526.00000212F783A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F6F84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342735017.00000212F77CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348344171.00000212F8031000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/wheel/issues	METADATA0.0.dr	false		high
https://httpbin.org/post	file.exe, 00000002.00000003.1338321600.00000212F6F7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338635084.00000212F6F84000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1358200539.00000212F6FA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339814178.00000212F6FA3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1264906153.00000212F6FA7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cpsU	file.exe, 00000002.00000003.1339124494.00000212F7007000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340256912.00000212F7007000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342510859.00000212F7007000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343409561.00000212F7009000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1346170179.00000212F700B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341711101.00000212F7007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Ousret/charset_normalizer	file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345753055.00000212F75BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/pyversions/importlib_metadata.svg	METADATA.0.dr	false		high
http://www.firmaprofesional.com/cps0	file.exe, 00000002.00000002.1359283331.00000212F7575000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341204034.00000212F769A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338891709.00000212F7685000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344203593.00000212F7566000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348842006.00000212F7573000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343297337.00000212F7565000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359911318.00000212F76A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F7687000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidelift.com/badges/package/pypi/importlib-metadata	METADATA.0.dr	false		high
https://github.com/urllib3/urllib3/issues/2920	file.exe, 00000002.00000002.1360826026.00000212F7880000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	file.exe, 00000002.00000003.1341474112.00000212F7668000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342001551.00000212F766F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349713536.00000212F7672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F765F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352042474.00000212F7590000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344203593.00000212F7566000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1348842006.00000212F7573000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1343297337.00000212F7565000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359349740.00000212F7590000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	file.exe, 00000002.00000003.1341474112.00000212F7668000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342001551.00000212F766F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1349713536.00000212F7672000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F765F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22	METADATA.0.dr	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	file.exe, 00000002.00000003.1339617797.00000212F6B87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341984926.00000212F6C02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339250188.00000212F6B86000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341394768.00000212F6BA2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341937070.00000212F6BC7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342173826.00000212F6C04000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1345857458.00000212F7481000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341565634.00000212F6BBC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1351184985.00000212F74A4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338958549.00000212F6B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359035153.00000212F74A7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340126815.00000212F6BA0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wheel.readthedocs.io/	METADATA0.0.dr	false		high
https://html.spec.whatwg.org/multipage/	file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1352042474.00000212F7590000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1344955658.00000212F758F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341048983.00000212F758E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.1359349740.00000212F7590000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	file.exe, 00000002.00000003.1341474112.00000212F7668000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1338165242.00000212F765F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341092627.00000212F765F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	file.exe, 00000002.00000003.1339992023.00000212F7586000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1341348638.00000212F75C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1339395412.00000212F7523000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1340808611.00000212F75C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1342216843.00000212F75D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings	file.exe, 00000002.00000002.1360903777.00000212F79B0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.142.108	script.irisstealer.xyz	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1563600
Start date and time:	2024-11-27 08:25:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal52.troj.evad.winEXE@6/77@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 102 Number of non-executed functions: 257
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	BitlordSetup_VOdKHS_0454250829.exe	Get hash	malicious	Deal Ply	Browse	104.21.61.178
	BitlordSetup_VOdKHS_0454250829.exe	Get hash	malicious	Deal Ply	Browse	172.67.212.154
	file.exe	Get hash	malicious	Unknown	Browse	104.21.82.174
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	104.29.206.99
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.208
	ORDER-2411250089.PDF.js	Get hash	malicious	WSHRat, PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.80.208
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.80.208
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.153.209

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_Salsa20.pyd	SecurityUpdate.exe	Get hash	malicious	Unknown	Browse
	SnapshotLogExtractor.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_ARC4.pyd	SecurityUpdate.exe	Get hash	malicious	Unknown	Browse
	SnapshotLogExtractor.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_chacha20.pyd	SecurityUpdate.exe	Get hash	malicious	Unknown	Browse
	SnapshotLogExtractor.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.634028407547307
Encrypted:	false
SSDEEP:	96:z8MwxTCa5Xv7BelL7u1R/r8qJ7pfpsPG6QEYHGBp5WCmNniHisDJ9UFv4:zTwxTltlelL7urFfUQa5NmYjDLU
MD5:	BA43C9C79B726F52CD3187231E3A780F
SHA1:	EC0538F8F32F3C58CB7430E82C416B44C0B03D12
SHA-256:	7B5E1F955E198278A39B94F6AC18D49CEE21B99C8A951DE722FF99A153162A0B
SHA-512:	A74056F9D853B2F020800D9DB0C1C50AD704E5DBD6B9A0A169E1BCC6299AB02E5D1F6A9C0A4FEBE9E14D8FE3264D836E67ADCD1AD2F1C380FED4A98A48E3F3E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecurityUpdate.exe, Detection: malicious, Browse Filename: SnapshotLogExtractor.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................@......................@.......@.......@.......f.......f.......f.......f.......Rich............................PE..d...a."`.........." ................T........................................p............`.........................................`'.......(..d....P.......@...............`..$....!...............................!..8............ ...............................text............................... ..`.rdata...... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..$....`.....................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.010720322611065
Encrypted:	false
SSDEEP:	192:EUBpDmr37utd9PHv2DznuRGMeS4JUHNDLUYd:mDit6DCVn4WZUW
MD5:	991AA4813AF0ADF95B0DF3F59879E21C
SHA1:	E44DB4901FFBBB9E8001B5B3602E59F6D2CCC9C8
SHA-256:	5B86D84DA033128000D8BC00A237AB07D5FF75078216654C224854BEC0CD6641
SHA-512:	C6A9DB8338330AB45A8522FBEF5B59374176AC4BF2C0BAE6471AA6FA4710B7EFE20E9331BA542FA274D32DE623A0B578A1A048765F000F74B1608FFA05E5C550
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecurityUpdate.exe, Detection: malicious, Browse Filename: SnapshotLogExtractor.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................K........................&.......................................'............Rich....................PE..d...b."`.........." ................T.....................................................`.........................................@8.......9..d....`.......P..L............p..$....1...............................1..8............0...............................text...x........................... ..`.rdata..2....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.030943993303202
Encrypted:	false
SSDEEP:	192:fhgUBpDmr37utd9PVv2Jnl0Ne3erKr5okiy0Y23RAr2Z9lkNCqDLU/:sDitwJooNiyX2hUA9f0U/
MD5:	43C8516BE2AE73FB625E8496FD181F1C
SHA1:	6D38E8EE6D38759FDBA6558848DA62BB3FB51EC8
SHA-256:	3A1ACFA87110ACE2F8B8F60B03E264F22E2B7E76B53AD98C3B260686B1C27C57
SHA-512:	B8DCD4875EF7759DA1F8B96FC85DAC8910720C8168F09AC52DAF85C637955274093530406BE2A58EF237BFAB8CCDF4F06F96EBA7ADFC4F413CBF0E5A7D447774
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecurityUpdate.exe, Detection: malicious, Browse Filename: SnapshotLogExtractor.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................K........................&.......................................'............Rich....................PE..d...b."`.........." ................T.....................................................`..........................................7.......8..d....`.......P..d............p..$....1...............................1..8............0...............................text...(........................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..$....p.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	6.5985845002689825
Encrypted:	false
SSDEEP:	384:ZOISQpPUUllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52E0H680xz4e:nLh7JbH1G4sS4j990th9VQFI
MD5:	DACF0299F0ACD196C0B0C35440C9CF78
SHA1:	CFFD37FE04854D60E87058B33CA313F532879BF7
SHA-256:	1199152F31FC5179FD39733B6B7D60B7F4A7269FE28CBC434F87FA53810B305D
SHA-512:	7FFA5A8979F4258968E37540348E62FD22C795981F4AA9A6962DDEC17CEC8265EC7A7FF7EE4A2EBADF4DA35062972E4C7ADF7C8D4031B60AE218872807E092D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................@......................@.......@.......@.......f.......f.......f.......f.......Rich............................PE..d...]."`.........." .....H...F......T.....................................................`.........................................0...........d...............................0......................................8............`...............................text....G.......H.................. ..`.rdata...5...`...6...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.181873142782463
Encrypted:	false
SSDEEP:	192:9Ee15je/I3TuvPfB1LeLi2jcXdq2QdeJgDZETDRcYcaKAADLU5YUod:992Y6/B1KL4XdQdggDZ8EU5YUm
MD5:	5D1CAEEDC9595EC0A30507C049F215D7
SHA1:	B963E17679A0CB1EFDC388B8218BE7373DE8E6CC
SHA-256:	A5C4143DDFA6C10216E9467A22B792541096E222EFE71C930A5056B917E531A0
SHA-512:	BE8471BE53AFA1EDCAA742B7D1D4222D15D4682BA8E1F8376FC65C46CCC5FE0890D24BBAFB6616F625D5D37A087762317EBAA4AE6518443E644FA01EBC4496E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................[........................*.......................................7............Rich....................PE..d...]."`.........." ......... ......T.....................................................`.........................................p9.......:..d....`.......P...............p..$....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..$....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.400580637932519
Encrypted:	false
SSDEEP:	192:rEJe0rPeLTuUt4/wgroOCouz7ucc9dJ7oAAokDLU45Gc:3mUGr9n6769laU45
MD5:	4795B16B5E63AEE698E8B601C011F6E6
SHA1:	4AA74966B5737A818B168DA991472380FE63AD3E
SHA-256:	78DB7D57C23AC96F5D56E90CFB0FBB2E10DE7C6AF48088354AA374709F1A1087
SHA-512:	73716040ECF217E41A34FADEA6046D802982F2B01D0133BFD5C215499C84CB6D386AF81235CA21592722F57EA31543D35B859BE2AF1972F347C93A72131C06C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...]."`.........." ....."... ......T.....................................................`.........................................@I.......I..d....p.......`..................$....B...............................B..8............@...............................text...8 .......".................. ..`.rdata.......@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..$............>..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	6.159203027693185
Encrypted:	false
SSDEEP:	192:iUpJ7Grjup/vx81AguKUiZA3OkJYkO8d3KobfoHJAyZJg8D0KThxA+rAQE+tnJi8:I2XKAs3ZArTvHbgpJgLa0Mp83xhUoz
MD5:	9F33973B19B84A288DF7918346CEC5E4
SHA1:	A646146337225D3FA064DE4B15BF7D5C35CE5338
SHA-256:	DC86A67CFF9CB3CC763AAAB2D357EC6DBC0616A5DFC16EBE214E8E2C04242737
SHA-512:	D7FFA4A640EBD2C9121DBD1BA107B5D76C0385524C4F53DE6FDA1BB0EC16541CEF1981F7E1DAA84F289D4A7D566B0620690AF97AF47F528BBF5B2CD6E49FE90C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...^."`.........." .....$..........T.....................................................`..........................................X.......Y..d............p..................0....Q...............................R..8............@...............................text...H#.......$.................. ..`.rdata.......@.......(..............@..@.data...H....`.......F..............@....pdata.......p.......H..............@..@.rsrc................L..............@..@.reloc..0............N..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.493034619151615
Encrypted:	false
SSDEEP:	384:pksGDsFSQkHUleKaZXmrfXA+UA10ol31tuXOQkUdT:kTK0K4XmrXA+NNxW+Ud
MD5:	89D4B1FC3A62B4A739571855F22E0C18
SHA1:	F0F6A893A263EEEB00408F5F87DC9ABB3D3259A6
SHA-256:	3832F95FE55D1B4DA223DF5438414F03F18D5EF4AAFD285357A81E4ED5AD5DA1
SHA-512:	20C713564C0658FD7A26F56BF629B80FCB4E7F785E66A00163933D57C8E5A344F6B0476F7395A6D8A526D78A60C85884CEFF6B3F812A8EE07E224C9E91F878C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................K........................&.......................................'............Rich....................PE..d...^."`.........." .....$...>............................................................`.........................................@h.......h..d...............................0....a...............................a..8............@...............................text...x".......$.................. ..`.rdata...,...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.700268562557766
Encrypted:	false
SSDEEP:	192:zh05p7mr3Tutd9PUv2anKfI1ve86rYDLUa:tD6t/GKfevTTUa
MD5:	73DD025BFA3CFB38E5DAAD0ED9914679
SHA1:	65D141331E8629293146D3398A2F76C52301D682
SHA-256:	C89F3C0B89CFEE35583D6C470D378DA0AF455EBD9549BE341B4179D342353641
SHA-512:	20569F672F3F2E6439AFD714F179A590328A1F9C40C6BC0DC6FCAD7581BC620A877282BAF7EC7F16AAA79724BA2165F71D79AA5919C8D23214BBD39611C23AED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...`."`.........." ................T.....................................................`..........................................7.......8..d....`.......P..X............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..$....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.99372428436515
Encrypted:	false
SSDEEP:	192:Dardk3qQb3GukBPZCLfSQl+x5DLUzbgd6:dNzFkHCLKUzbO
MD5:	E87AAC7F2A9BF57D6796E5302626EE2F
SHA1:	4B633501E76E96C8859436445F38240F877FC6C6
SHA-256:	97BF9E392D6AD9E1EC94237407887EA3D1DEC2D23978891A8174C03AF606FD34
SHA-512:	108663F0700D9E30E259A62C1AE35B23F5F2ABD0EFF00523AAE171D1DB803DA99488C7395AFD3AD54A242F0CB2C66A60E6904D3E3F75BB1193621FD65DF4AD5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................@....................@......@......@......f......f......f.~.....f......Rich....................PE..d...`."`.........." ................T.....................................................`..........................................8......H9..d....`.......P..d............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..$....p.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.274628449067808
Encrypted:	false
SSDEEP:	192:ktVGzeoI3DuzPpcAdXdO57EEE/quBiFElcUNIDLUnF6+ud:nNYqFcAdXdDqurIUnUp
MD5:	F3F30D72D6D7F4BA94B3C1A9364F1831
SHA1:	46705C3A35C84BF15CF434E2607BDDD18991E138
SHA-256:	7820395C44EAB26DE0312DFC5D08A9A27398F0CAA80D8F9A88DEE804880996FF
SHA-512:	01C5EA300A7458EFE1B209C56A826DF0BF3D6FF4DD512F169D6AEE9D540600510C3249866BFB991975CA5E41C77107123E480EDA4D55ECCB88ED22399EE57912
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........o....................@......................@.......@.......@.......f.......f.......f.......f.......Rich............................PE..d...a."`.........." ......... ......T.....................................................`.........................................P9.......:..d....`.......P...............p..$....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..$....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	4.23001088085281
Encrypted:	false
SSDEEP:	384:m3gj0/sz71dv/ZHkVnYcZiGKdZHDLIK4vnKAnKorZOzUbq+K9:7jssHZHTr4vZHb69
MD5:	020A1E1673A56AF5B93C16B0D312EF50
SHA1:	F69C1BB224D30F54E4555F71EA8CAD4ACB5D39BC
SHA-256:	290B3ED6151B7BF8B7B227EF76879838294F7FF138AF68E083C2FDDC0A50E4FC
SHA-512:	71B5ED33B51F112896BB59D39B02010B3ABC02B3032BD17E2AA084807492DA71BDE8F12ADEF72C6CC0A5A52D783CD7595EEC906C394A21327ADAB2927E853B1F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Sj..2...2...2...J...2..LC...2...Y...2...2...2..LC...2..LC...2..LC...2..j@...2..j@...2..j@...2..j@...2..Rich.2..........................PE..d..._."`.........." .....6...................................................0............`.....................................................d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata..T....P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.2510443883540265
Encrypted:	false
SSDEEP:	384:wVgj0/sKzNweVC/ZHkNnYcZiGKdZHDLaK0vnKAnKLrZVwUbqeo:njsskKZHLR0vZmbx
MD5:	EC55478B5DD99BBE1EBA9D6AD8BDE079
SHA1:	EC730D05FEEC83B1D72784C2265DC2E2CF67C963
SHA-256:	1AF46CBE209E3F1D30CCC0BA9F7E5A455554CAF8B1E3E42F9A93A097D9F435AC
SHA-512:	55FE28E839117A19DF31165FEA3DED3F9DFC0DDA16B437CF274174E9AE476C0E5B869FFB8B2CF1880189BFAC3917E8D7078FA44FC96CFF18DC6EAC7AFA7A8F48
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Sj..2...2...2...J...2..LC...2...Y...2...2...2..LC...2..LC...2..LC...2..j@...2..j@...2..j@...2..j@...2..Rich.2..........................PE..d..._."`.........." .....8...................................................0............`.................................................`...d............................ ..0... ...............................@...8............P...............................text...h7.......8.................. ..`.rdata.......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.689882120894326
Encrypted:	false
SSDEEP:	96:5D8MdJTCaDAH37Belrzu1x/r8qJ7pfJsPG6QxmFWymc3doBKumsLVsDJ9UKvL:lTdJTlDmNelrzuLFf0Qg4yxlumQCDLU
MD5:	93DA52E6CE73E0C1FC14F7B24DCF4B45
SHA1:	0961CFB91BBCEE3462954996C422E1A9302A690B
SHA-256:	DDD427C76F29EDD559425B31EEE54EB5B1BDD567219BA5023254EFDE6591FAA0
SHA-512:	49202A13D260473D3281BF7CA375AC1766189B6936C4AA03F524081CC573EE98D236AA9C736BA674ADE876B7E29AE9891AF50F1A72C49850BB21186F84A3C3AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mr..............t......,}.......g..............,}......,}......,}.......~.......~.......~.......~......Rich............................PE..d...`."`.........." ................T........................................p............`..........................................&.......'..P....P.......@...............`..$....!...............................!..8............ ...............................text............................... ..`.rdata..p.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..$....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.2360102418962855
Encrypted:	false
SSDEEP:	384:42XHEtPwbdvIbwKBBEHYpJgLa0Mp8u9sLgU:jHMobBiB+HqgLa1Kx
MD5:	3D34E2789682844E8B5A06BE3B1C81BF
SHA1:	0141D82B4B604E08E620E63B8257FB6A1E210CAF
SHA-256:	40B1A6F1318C565E985AFFB8DF304991E908AB1C36C8E960E7AC177E3002FCA0
SHA-512:	886780D6CE3F2955C8FAC38F75DC3A2E017F68ED8FCC75BAA6D74A5E4018CFBF2B99F59D0DBFA5D2728EB1AD7F3F8FE54F0AD3F29D74AFC43E2CDC1A21F889C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...^."`.........." .....(..........T.....................................................`..........................................X.......Y..d............p..................0....Q...............................R..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data...H....`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..0............R..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.285518610964193
Encrypted:	false
SSDEEP:	384:txQrFBe/i+/puqeXOv3oTezczeO9p9iYDWYLJzUn:Q5B8txuqeXOfoTezcSO9pUY1JY
MD5:	194D1F38FAB24A3847A0B22A120D635B
SHA1:	A96A9DF4794CDA21E845AAFE2D5ACD5A40A9C865
SHA-256:	FCC68F211C6D2604E8F93E28A3065F6E40F1E044C34D33CC8349EB3873559A0C
SHA-512:	07324B03B7DD804090B00BC62C41162FD1788AE3C8450BCA25D63BF254009D04A7ACDF7ACFAF473A3D1BE1FA58B0007FA35D8E486F90C9B48384C035C83B0CCF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...a."`.........." .....(... ......T.....................................................`.........................................@I......<J..d....p.......`..................$....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..$............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.696064367032408
Encrypted:	false
SSDEEP:	192:V05p7mr3Tutd9PUv22NeLfPI5k3bo7tDLUan:tD6t/N4a3bEZUan
MD5:	0628DC6D83F4A9DDDB0552BD0CC9B54C
SHA1:	C73F990B84A126A05F1D32D509B6361DCA80BC93
SHA-256:	F136B963B5CEB60B0F58127A925D68F04C1C8A946970E10C4ABC3C45A1942BC7
SHA-512:	78D005A2FEC5D1C67FC2B64936161026F9A0B1756862BAF51EAF14EDEE7739F915D059814C8D6F66797F84A28071C46B567F3392DAF4FF7FCDFA94220C965C1A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...`."`.........." ................T.....................................................`..........................................7.......8..d....`.......P..X............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..$....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.219784380683583
Encrypted:	false
SSDEEP:	192:305p7mr3Tutd9Pwv2e42bF7i+V2rQnjt1wmg9jN+mp23XDLUk:rD6tTephi+AojO9jbQHUk
MD5:	59F65C1AD53526840893980B52CD0497
SHA1:	E675A09577C75D877CB1305E60EB3D03A4051B73
SHA-256:	2DF02E84CFD77E91D73B3551BDDA868277F8AE38B262FA44528E87208D0B50FC
SHA-512:	5E9782793A8BB6437D718A36862C13CDE5E7E3780E6F3E82C01F7B2F83EBBDB63F66B3C988FA8DEF36077F17FA1F6C2C77A82FABBD7C17D1568E7CEA19E7EDD6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...[."`.........." ................T.....................................................`..........................................8......\|9..d....`.......P..@............p..$....2...............................2..8............0...............................text............................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..$....p.......6..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.171175600505211
Encrypted:	false
SSDEEP:	192:O05p7mr3Tutd9Pwv2aKbxdcgatX1WmkaA09L9kDLUhX:MD6tTZgtX15kanYU
MD5:	4D8230D64493CE217853B4D3B6768674
SHA1:	C845366E7C02A2402BA00B9B6735E1FAD3F2F1EF
SHA-256:	06885DC99A7621BA3BE3B28CB4BCF972549E23ACF62A710F6D6C580AABA1F25A
SHA-512:	C32D5987A0B1DED7211545CB7D3D7482657CA7D74A9083D37A33F65BBE2E7E075CB52EFAEEA00F1840AB8F0BAF7DF1466A4F4E880ABF9650A709814BCEE2F945
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...\."`.........." ................T.....................................................`..........................................8.......9..d....`.......P..@............p..$....2...............................2..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.171087190344686
Encrypted:	false
SSDEEP:	384:ajJzPAI2p3C2p+EhKnLg9yH8puzoFaPERIQAVqYU:GITp3pp+EhmLg9yH8puzoFaPERIQp
MD5:	4B4831FCFCA23CEBEC872CCCCE8C3CE1
SHA1:	9CA26A95C31E679B0D4CFEDEACEA38334B29B3F3
SHA-256:	75250C7B7EE9F7F944D9C23161D61FE80D59572180A30629C97D1867ECF32093
SHA-512:	7218D67A78EBC76D1AA23AEDDF7B7D209A9E65D4A50FD57F07680953BDF40E42B33D3D6388119B54E3948DA433D0F895BCC0F98E6D1AF4B9821AEFE2300C7EA0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...V."`.........." ................T.....................................................`..........................................9.......9..d....`.......P..(............p..$....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...x....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.0894476079532565
Encrypted:	false
SSDEEP:	192:ZE4+jfKIb3gudUPpwVp1sAD7I/9hAkeTOre5QDLU+db:CjJzPQwVp1sAD7KvpUv5uUob
MD5:	642B9CCEA6E2D6F610D209DC3AACF281
SHA1:	8F816AA1D94F085E2FE30A14B4247410910DA8F9
SHA-256:	E5DFB0A60E0E372AE1FF4D0E3F01B22E56408F0F9B04C610ECEF2A5847D6D879
SHA-512:	A728E2F6264A805CE208FEB24600D23EC04C7D17481A39B01F90E47D82CF6C369D6151BB4170D993BE98CEFE8E6BDF2044CF0DC623BAE662C5584812875FC3B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...V."`.........." ................T.....................................................`..........................................8.......8..d....`.......P..(............p..$....1...............................2..8............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.432796797907171
Encrypted:	false
SSDEEP:	192:N9FZ/KFjb3OuTPU84At56BTBvzcuiDSjeoGIQUPTrLFDLUEPLdN:/wztA8Tt5OwuiDSyoGPmXdUEPB
MD5:	180017650B62058058CB81B53540A9BF
SHA1:	696EECA75621B75BC07E2982EB66D61A1DFECDB6
SHA-256:	8146110D92B2F50B3EB02557BE6EE4586EEC1A2AD7204B48A4F28B8859FE6E29
SHA-512:	9AD447F0B15639C1FA3300E80EC5B175589930CB9166CF108FAFA74093CE791E1FF55CF6686ABF090A8B44BA6B743FEEBA270F378ED405F15418406AB8D01E9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...W."`.........." ..... ..........T.....................................................`.........................................P8...... 9..d....`.......P..X............p..$....1...............................1..8............0...............................text............ .................. ..`.rdata..p....0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..$....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.099895592918567
Encrypted:	false
SSDEEP:	192:s05p7mr3Tutd9Pgv239k9UgPKsVQJukk7+rDLU8:OD6tD3G9tPKsVQJuUDU
MD5:	11F184E124E91BE3EBDF5EAF92FDE408
SHA1:	5B0440A1A2FBD1B21D5AF7D454098A2B7C404864
SHA-256:	F9220CA8A1948734EC753B1ADA5E655DAF138AF76F01A79C14660B2B144C2FAE
SHA-512:	37B3916A5A4E6D7052DDB72D34347F46077BDF1BA1DCF20928B827B3D2C411C612B4E145DFE70F315EA15E8F7F00946D26E4728F339EDDF08C72B4E493C56BC3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...Z."`.........." ......... ......T.....................................................`.........................................p9......H:..d....`.......P...............p..$...@3..............................`3..8............0...............................text...X........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.65813713656815
Encrypted:	false
SSDEEP:	192:Bj51JwTx7uuj/krY1ZLhGZo2R1J+0eDPSgkNZuOdlptvTLLB5b+vDLUE+Ea:sxQr89hTOJ+0QPSfu6rlZ+/UE+
MD5:	51A01A11848322AC53B07D4D24F97652
SHA1:	141097D0F0F1C5432B1F1A571310BD4266E56A6D
SHA-256:	E549A4FE85759CBFC733ECF190478514B46ECA34EDA2370F523328F6DC976F30
SHA-512:	23281BE77496AF3A6507B610191AF5AA005C974F27129073FD70D51E82A5D3E55FB8C7FF28CF1886B55E264B736AB506EE0D97210E764EB1618C74DE2B44E64A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...W."`.........." ...............T.....................................................`.........................................PH......(I..d....p.......`..X...............$....A...............................A..8............@...............................text....)......................... ..`.rdata..x....@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..$............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.882538742896355
Encrypted:	false
SSDEEP:	384:lRlEGHXgKXqHGcvYHp5RYcARQOj4MSTjqgPmEO2vUk:NdHXgP/YtswvdUk
MD5:	B20D629142A1354BA94033CAC15D7D8C
SHA1:	CD600F33D5BC5FA3E70BDF346A8D0FB935166468
SHA-256:	147CE6747635B374570D3A1D9FCAB5B195F67E99E34C0F59018A3686A07A3917
SHA-512:	72EFD1C653732FB620787B26D0CA44086405A070EC3CD4BBA5445854C5D7DDE6D669060845D093A1FC2593ED6E48630344FA6F0AF685186FB554D8BB9BC97AA0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...Y."`.........." .....6... ......T.....................................................`..........................................Z.......Z..d............p..................$....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..8....P.......:..............@..@.data...(....`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..$............R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.88515673373227
Encrypted:	false
SSDEEP:	384:ARlEGHXiKXqHGcvYHp5RYcARQOj4MSTjqgPmEm9Uk:SdHXiP/YtswvdVk
MD5:	6FF2518A93F7279E8FDAC0CE8DE4BF3F
SHA1:	77F4713D4F287E2950C06A0EF2F8C7C8D53BABDD
SHA-256:	27B4DB005685D8E31E37BD632767D5FFC81818D24B622E3D25B8F08F43E29B57
SHA-512:	26A8448D34F70AF62D702851B8353708FB3A1B984CBDC1D2EABE582CAAD8D56B0A835A4C914EB7824DADCF62E83B84D3A669C06ACAF0E1001EB66F85BC5D0377
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...X."`.........." .....6... ......T.....................................................`..........................................Z.......Z..d............p..................$....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..8....P.......:..............@..@.data...(....`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..$............R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.843159039658928
Encrypted:	false
SSDEEP:	768:2HJh9k54Stui0gel9soFdkO66MlPGXmXcCkyk:2H6Ju/FZ6nPxM6k
MD5:	8B59C61BB3A3ADFBB7B8C39F11B8084B
SHA1:	49595C3F830422FEF88D8FBAF003F32EF25501CE
SHA-256:	FBD9CDD873EAFAD3C03C05FFEB0D67F779C2D191389351FE2D835E7D8ECA534F
SHA-512:	6FEDCC8631723B63D3D8CAD6D57953EB356C53814FD6F1ECA6299E2A5272F67C58090D339B5E6BB1DA15F7BEB451FCC9A41129AB7F578155A17BBE0C1D385AA6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...Y."`.........." .....H..."......T.....................................................`..........................................k......hl..d...............................$...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data...(............^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..$............f..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.896939915107
Encrypted:	false
SSDEEP:	768:VxpB9/i4z5tui0gel9soFdkO66MlPGXmXcPtOJkw:Vx11u/FZ6nPxM8k
MD5:	6A84B1C402DB7FE29E991FCA86C3CECF
SHA1:	FC62477E770F4267C58853C92584969B2F0FEBE2
SHA-256:	CF8FD7B6BBC38FE3570B2C610E9C946CD56BE5D193387B9146F09D9B5745F4BC
SHA-512:	B9D1195429E674778A90262E0A438B72224B113B7222535DAA361222DEE049C9929481D6E1138117655EAE9B2735D51638209A6EF07963F5249AD74F0BFD75C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...Z."`.........." .....H..."......T.....................................................`..........................................l.......l..d...............................$....d...............................e..8............`...............................text...xG.......H.................. ..`.rdata..H....`.......L..............@..@.data...(............^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..$............f..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.957384431518367
Encrypted:	false
SSDEEP:	192:PUBpDmr37utd9PHv2O3sER2fi2s4DLUgdLl:zDit6O3sa4XUO
MD5:	1D49E6E34FE84C972484B6293CC2F297
SHA1:	3A799DB7102912DA344112712FD2236A099C7F5E
SHA-256:	B2FD9F57815B3F7FFC3365D02510B88DBE74AB1EFF8BE9099DC902412057244D
SHA-512:	CAD8FCC78006D643590C3D784C2DF051B8C448DE457B41507F031C9D7891036AD3F8E00B695D92F5138C250B2426A57C16F7293237054A245FF08B26AD86CF25
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................@......................@.......@.......@.......f.......f.......f.......f.......Rich............................PE..d...\."`.........." ................T.....................................................`..........................................8.......8..d....`.......P...............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..$....p.......0..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.014628606839607
Encrypted:	false
SSDEEP:	192:lUBpDmr37utd9PVv27c0qKzLF4DHxXUcDLU/:9DitwzvV4DREiU/
MD5:	CDD1A63E9F508D01EEBEE7646A278805
SHA1:	3CB34B17B63F2F61C2FA1B1338D0B94CF9EE67AF
SHA-256:	AB96945D26FEF23EF4B12E1BD5B1841CFECB8B06AB490B436E3F1A977A7F5E8B
SHA-512:	5F136D8EBFE6AC43846C4820FF8A3C81D991FCACC219C23DDD0674E75B930A1A948D02925BCC7BD807F5A68F01F65B35037B8A193143EB552D224E1DD906C158
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................K........................&.......................................'............Rich....................PE..d...\."`.........." ................T.....................................................`..........................................7.......8..d....`.......P..X............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..$....p.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.243633265407984
Encrypted:	false
SSDEEP:	192:QUN0iKNb3NuUPyxfFNhoCoK7e+TcBXJ2kMQ75i6nElDLUH:dYz8JpF39oK6+QBXJ2k775NKU
MD5:	57A49AC595084A19516C64079EE1A4C7
SHA1:	4B188D0E9965AB0DA8D9363FC7FEEE737DF81F74
SHA-256:	D7DA3DC02AC4685D3722E5AF63CA1A8857D53454D59CF64C784625D649897D72
SHA-512:	693989D01070835DC9D487C904F012EE5BE72219E1EEAEC56EE3BC35659192714D8F538BEA30F4849B3A3D4BCF24705EDFE84AD2742F6C8562F6C6215F7917BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...[."`.........." ..... ..........T.....................................................`..........................................8.......9..d....`.......P..d............p..$...p2...............................2..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..d....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..$....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.253962925838046
Encrypted:	false
SSDEEP:	192:t39lJPKBb3+ujPH/41fPnVSEsV3+ldpCArU8vOjpDLUFDdA:V9wzdz/afPCV3YdjdvMUFpA
MD5:	C19895CE6ABC5D85F63572308BD2D403
SHA1:	6B444E59112792B59D3BA4F304A30B62EEBD77FA
SHA-256:	1BCA3479A4CC033E8BC3B4DD8DCC531F38E7B7FE650A7DA09120CCAC100D70A4
SHA-512:	D8D493D51DE052F2A0BB18C4CD6F5E15AB5D5CCB3276D38DDA44382746656618560878359D6C95A76B223CBD4B2CD39C817EC7FC3108EED5D541CF4BD95AAA14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...\."`.........." ................T.....................................................`..........................................8......h9..d....`.......P..\|............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..\|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..$....p.......8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.913715253597897
Encrypted:	false
SSDEEP:	384:4ea6OoLEx/fpMgEXNSNk/IppSQDLw16UADNIz7Izy+3O3nCpDN+cGJVtV81UpSu8:44OoMpMgqSpz41ht7EOeYcUV4ipwr
MD5:	150F31A18FDCCB30695E8A11B844CB9A
SHA1:	85A333C8A866AAFBF6B3766CED0B7079A2358C42
SHA-256:	D26D543EFC9A6C3D5BA52FFC55965A2C3DBB7E634776EF6C1789E5DF8E4DF3E5
SHA-512:	DDFE93CBE315E060A8F0B3863A1675D8F156BF84F157CD7BCBD7EC57F88C72DD21E6C2A5077A142D828DAD0C40149EE4064C34E6EE26787A8B32D4AC9A18E1CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P.R.>.R.>.R.>.[...V.>..?.P.>.F.?.Q.>.R.?.{.>..;.Y.>..:.Z.>..=.Q.>..6.V.>..>.S.>....S.>..<.S.>.RichR.>.........PE..d...i."`.........." .....V...,............................................................`..........................................~..d.......d...............T...............$....q...............................q..8............p..(............................text...(U.......V.................. ..`.rdata.......p.......Z..............@..@.data...H............n..............@....pdata..T............t..............@..@.rsrc................\|..............@..@.reloc..$............~..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.725087774300977
Encrypted:	false
SSDEEP:	192:N942/KIb3bu95Pp2abc64uVNn4DLUOVdB:FJzCxl464aGUOf
MD5:	66052F3B3D4C48E95377B1B827B959BB
SHA1:	CF3F0F82B87E67D75B42EAAB144AE7677E0C882E
SHA-256:	C9A6A7D7CE0238A8D03BCC1E43FD419C46FAEA3E89053355199DEDF56DADAFA4
SHA-512:	9A7F45CE151890032574ED1EF8F45640E489987DC3AF716E5D7F31127BA3675E1F4C775229184C52D9A3792DF9CB2B3D0D3BE079192C40E900BA0CC69E8E3EE5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........./...A...A...A.......A.@.@...A...@...A...@..A.@.D...A.@.E...A.@.B...A.f.I...A.f.A...A.f....A.f.C...A.Rich..A.........................PE..d...b."`.........." ................T.....................................................`.........................................P8..d....8..d....`.......P..4............p..$....1...............................1..8............0...............................text...X........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..$....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	748032
Entropy (8bit):	7.627003962799197
Encrypted:	false
SSDEEP:	12288:b3HtKHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:b3NKHoxJFf1p34hcrn5Go9yQO6
MD5:	B96D4854F02D932D9D84DB7CE254C85A
SHA1:	61F8F284EEB65B21A5373DA85270802B9E0ABBF4
SHA-256:	E73BC5D362A1439FD87BF3901D5B2D4534B50E3B935C841F25D3C49BF3D4D7EE
SHA-512:	1FDE226034F48B29143E1B3042FB42C91BE8DE5DDC53B2F2FA3DAB1CCA99FB34AF3A8FB57B0CB5B152943BE156B4521DAE04FB80B08EC04A3F371E30D137297A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.2...a...a...a.sba...alz.`...a.`.`...a...a...alz.`...alz.`...alz.`...aJy.`...aJy.`...aJy.a...aJy.`...aRich...a........................PE..d...g."`.........." .....V................................................................`.........................................p_.......a..d...............H...............0....H...............................I..8............p..(............................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data...X....p.......P..............@....pdata..H............X..............@..@.rsrc................f..............@..@.reloc..0............h..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.662736103035243
Encrypted:	false
SSDEEP:	96:5y8MdJTCaDAH37Belrzu1x/r8qJ7pfJsPG6Q9qHaGi0oYAsDJ9UqvA:0TdJTlDmNelrzuLFf0Qd03DLU
MD5:	E17F1BA35CF28FA1DDA7B1EC29573E0E
SHA1:	6EB63305E38BD75931E3325E0C3F58F7CB3F2AD0
SHA-256:	D37CCB530F177F3E39C05B0CA0A70661B2541CCAF56818DAD4FCF336EEED3321
SHA-512:	8E7AF8712592084178E3B93FE54E60AC32A774D151896AFEE937CDB3BB9F629F4B597F85AF9B56A1C14612121357FC0DDAA45E71D91B13C36E88292D3050A1B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mr..............t......,}.......g..............,}......,}......,}.......~.......~.......~.......~......Rich............................PE..d...`."`.........." ................T........................................p............`..........................................'..\|...\|'..P....P.......@...............`..$....!...............................!..8............ ...............................text............................... ..`.rdata..H.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..$....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.620728904455609
Encrypted:	false
SSDEEP:	96:5Z8MdJTCaDAH37Belrzu1x/r8qJ7pfJsPG6QgcfPPYdsDJ9UKvb:nTdJTlDmNelrzuLFf0Q5P3DLU
MD5:	3369F9BB8B0EE93E5AD5B201956DC60F
SHA1:	A5B75CBD6CE905A179E49888E798CD6AE9E9194D
SHA-256:	5940E97E687A854E446DC859284A90C64CF6D87912C37172B8823A8C3A7B73DF
SHA-512:	C4E71D683BE64A8E6AB533FA4C1C3040B96D0BE812EA74C99D2D2B5D52470C24B45D55366A7ACB9D8CDA759A618CBAF0D0A7ECFEF4C0954DF89FDB768D9893E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mr..............t......,}.......g..............,}......,}......,}.......~.......~.......~.......~......Rich............................PE..d...b."`.........." ................T........................................p............`..........................................&..t...d'..P....P.......@...............`..$....!...............................!..8............ ...............................text...x........................... ..`.rdata..0.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..$....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64424
Entropy (8bit):	6.124000794465739
Encrypted:	false
SSDEEP:	1536:r/p7Wh7XUagO7BR4SjavFHx8pIS5nWQ7Sy7o:r/tWhzUahBR4Sjahx8pIS5n5Fo
MD5:	6EB3C9FC8C216CEA8981B12FD41FBDCD
SHA1:	5F3787051F20514BB9E34F9D537D78C06E7A43E6
SHA-256:	3B0661EF2264D6566368B677C732BA062AC4688EF40C22476992A0F9536B0010
SHA-512:	2027707824D0948673443DD54B4F45BC44680C05C3C4A193C7C1803A1030124AD6C8FBE685CC7AAF15668D90C4CD9BFB93DE51EA8DB4AF5ABE742C1EF2DCD08B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~[b...b...b...k..`.......`.......n.......j.......a.......a.......`...b..........c.......c.......c.......c...Richb...........PE..d....K.b.........." ... .T..........`...............................................^.....`.............................................P...P...d........................)...........w..T...........................@v..@............p.. ............................text....R.......T.................. ..`.rdata...I...p...J...X..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83368
Entropy (8bit):	6.530099411242372
Encrypted:	false
SSDEEP:	1536:asRz7qNFcaO6ViD4fhaLRFc/a8kd7jzWHCxIStVs7Sywk:9RzGYYhaY9kd7jzWixIStVs+k
MD5:	A4B636201605067B676CC43784AE5570
SHA1:	E9F49D0FC75F25743D04CE23C496EB5F89E72A9A
SHA-256:	F178E29921C04FB68CC08B1E5D1181E5DF8CE1DE38A968778E27990F4A69973C
SHA-512:	02096BC36C7A9ECFA1712FE738B5EF8B78C6964E0E363136166657C153727B870A6A44C1E1EC9B81289D1AA0AF9C85F1A37B95B667103EDC2D3916280B6A9488
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........{..{..{...#.{......{....M.{......{......{......{......{..Z...{..{...{......{......{....O.{......{..Rich.{..........PE..d....K.b.........." ... .....^..............................................P......& ....`.........................................p...H............0....... .. ........)...@..........T...........................p...@............................................text...O........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_cffi_backend.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	6.160618368535074
Encrypted:	false
SSDEEP:	3072:a28mc0wlApJaPh2dEVWkS0EDejc2zSTBcS7EkSTLkKDtJbtb:axTlApohBV1S0usWchkSTLLDDt
MD5:	2BAAA98B744915339AE6C016B17C3763
SHA1:	483C11673B73698F20CA2FF0748628C789B4DC68
SHA-256:	4F1CE205C2BE986C9D38B951B6BCB6045EB363E06DACC069A41941F80BE9068C
SHA-512:	2AE8DF6E764C0813A4C9F7AC5A08E045B44DAAC551E8FF5F8AA83286BE96AA0714D373B8D58E6D3AA4B821786A919505B74F118013D9FCD1EBC5A9E4876C2B5F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...p...p...p...p...p.y.q...p.y{p...p.y.q...p.y.q...p.y.q...p.q...pi..q...p...pX..p.x.q...p...p...p.x.q...p.xyp...p.x.q...pRich...p................PE..d......f.........." ...).....B.............................................. ............`.........................................PX..l....X.......................................?...............................=..@............................................text............................... ..`.rdata..............................@..@.data....].......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122792
Entropy (8bit):	6.021506515932983
Encrypted:	false
SSDEEP:	3072:bsQx9bm+edYe3ehG+20t7MqfrSW08UficVISQPkFPR:QQxCOhGB0tgqfrSiUficrZ
MD5:	87596DB63925DBFE4D5F0F36394D7AB0
SHA1:	AD1DD48BBC078FE0A2354C28CB33F92A7E64907E
SHA-256:	92D7954D9099762D81C1AE2836C11B6BA58C1883FDE8EEEFE387CC93F2F6AFB4
SHA-512:	E6D63E6FE1C3BD79F1E39CB09B6F56589F0EE80FD4F4638002FE026752BFA65457982ADBEF13150FA2F36E68771262D9378971023E07A75D710026ED37E83D7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T....ne..ne..ne......ne.p.d..ne.p.`..ne.p.a..ne.p.f..ne.t.d..ne...a..ne...d..ne...d..ne..nd..ne.t.h..ne.t.e..ne.t....ne.t.g..ne.Rich.ne.........PE..d....K.b.........." ... ............P[..............................................H.....`..........................................Q.......R...........................).......... ...T...............................@...............@............................text............................... ..`.rdata..nl.......n..................@..@.data...D>...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	250280
Entropy (8bit):	6.547354352688139
Encrypted:	false
SSDEEP:	6144:TogRj7JKM8c7N6FiFUGMKa3xB6Dhj9qWMa3pLW1A64WsqC:tPJKa7N6FEa3x4NlbqC
MD5:	10F7B96C666F332EC512EDADE873EECB
SHA1:	4F511C030D4517552979105A8BB8CCCF3A56FCEA
SHA-256:	6314C99A3EFA15307E7BDBE18C0B49BC841C734F42923A0B44AAB42ED7D4A62D
SHA-512:	CFE5538E3BECBC3AA5540C627AF7BF13AD8F5C160B581A304D1510E0CB2876D49801DF76916DCDA6B7E0654CE145BB66D6E31BD6174524AE681D5F2B49088419
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7.......................................+.........c.........................[...........Rich...........PE..d....K.b.........." ... .p...:.......................................................^....`..........................................D..P...@E...................'.......)......@...p...T...........................0...@............................................text...]o.......p.................. ..`.rdata...............t..............@..@.data....)...`...$...L..............@....pdata...'.......(...p..............@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61864
Entropy (8bit):	6.210920109899827
Encrypted:	false
SSDEEP:	768:aSz5iGzcowlJF+aSe3kuKUZgL4dqDswE9+B1fpIS5IHYiSyvc9eEdB:npWlJF+aYupZbdqDOgB1fpIS5IH7Sy+V
MD5:	49CE7A28E1C0EB65A9A583A6BA44FA3B
SHA1:	DCFBEE380E7D6C88128A807F381A831B6A752F10
SHA-256:	1BE5CFD06A782B2AE8E4629D9D035CBC487074E8F63B9773C85E317BE29C0430
SHA-512:	CF1F96D6D61ECB2997BB541E9EDA7082EF4A445D3DD411CE6FD71B0DFE672F4DFADDF36AE0FB7D5F6D1345FBD90C19961A8F35328332CDAA232F322C0BF9A1F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zD.A>%..>%..>%..7]..:%..^_..<%..^_..2%..^_..6%..^_..=%..Z_..<%...W..<%...\..=%..>%...%..Z_..?%..Z_..?%..Z_..?%..Z_..?%..Rich>%..................PE..d....K.b.........." ... .P...z.......<..............................................Np....`............................................P...@............................)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158120
Entropy (8bit):	6.838169661977938
Encrypted:	false
SSDEEP:	3072:MeORg8tdLRrHn5Xp4znfI9mNoY6JCvyPZxsyTxISe1KmDd:M/Rgo1L5wwYOY6MixJKR
MD5:	B5FBC034AD7C70A2AD1EB34D08B36CF8
SHA1:	4EFE3F21BE36095673D949CCEAC928E11522B29C
SHA-256:	80A6EBE46F43FFA93BBDBFC83E67D6F44A44055DE1439B06E4DD2983CB243DF6
SHA-512:	E7185DA748502B645030C96D3345D75814BA5FD95A997C2D1C923D981C44D5B90DB64FAF77DDBBDC805769AF1BEC37DAF0ECEE0930A248B67A1C2D92B59C250C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....................................................<.........................................Rich...........................PE..d....L.b.........." ... .d...........8...............................................p....`.........................................0%..L...\|%..x....p.......P.......@...)......H.......T...........................`...@............................................text...^c.......d.................. ..`.rdata..............h..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..H............>..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33192
Entropy (8bit):	6.3186201273933635
Encrypted:	false
SSDEEP:	768:Y3I65wgJ5xeSZg2edRnJ8ZISRtczYiSyvZCeEdP:gIgJ5Uqg2edRJ8ZISRtcz7Sy0b
MD5:	71AC323C9F6E8A174F1B308B8C036E88
SHA1:	0521DF96B0D622544638C1903D32B1AFF1F186B0
SHA-256:	BE8269C83666EAA342788E62085A3DB28F81512D2CFA6156BF137B13EBEBE9E0
SHA-512:	014D73846F06E9608525A4B737B7FCCBE2123D0E8EB17301244B9C1829498328F7BC839CC45A1563CF066668EA6E0C4E3A5A0821AB05C999A97C20AA669E9EDA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.+.>.x.>.x.>.x.Fgx.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.>.x.>.xmL.y.>.x.D.y.>.x.D.y.>.x.D.x.>.x.D.y.>.xRich.>.x........................PE..d....K.b.........." ... .....<......0....................................................`.........................................0D..`....D..x....p.......`.......X...)...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48552
Entropy (8bit):	6.319402195167259
Encrypted:	false
SSDEEP:	768:9i4KJKYCKlBj7gKxwfZQ7ZlYXF1SVMHE4ftISstDYiSyvM+eEd2:hKJfBuAA1SVWBftISstD7Syti
MD5:	7E6BD435C918E7C34336C7434404EEDF
SHA1:	F3A749AD1D7513EC41066AB143F97FA4D07559E1
SHA-256:	0606A0C5C4AB46C4A25DED5A2772E672016CAC574503681841800F9059AF21C4
SHA-512:	C8BF4B1EC6C8FA09C299A8418EE38CDCCB04AFA3A3C2E6D92625DBC2DE41F81DD0DF200FD37FCC41909C2851AC5CA936AF632307115B9AC31EC020D9ED63F157
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.K{8.%(8.%(8.%(1..(<.%(X.$):.%(X. )4.%(X.!)0.%(X.&);.%(\.$):.%(8.$(N.%(.$)=.%(.!)9.%(\.()9.%(\.%)9.%(\..(9.%(\.')9.%(Rich8.%(........PE..d....K.b.........." ... .>...X...... ................................................o....`..........................................w..X...(x...........................)...... ....V..T............................U..@............P...............................text....<.......>.................. ..`.rdata...4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_pytransform.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1164800
Entropy (8bit):	7.05748889255336
Encrypted:	false
SSDEEP:	24576:8RgySc2phTzucZzdcZ7fUoPTS4ObanoVen42fw5I:BySc2ptScvkosfcI
MD5:	E4761848102A6902B8E38F3116A91A41
SHA1:	C262973E26BD9D8549D4A9ABF4B7AE0CA4DB75F0
SHA-256:	9D03619721C887413315BD674DAE694FBD70EF575EB0138F461A34E2DD98A5FD
SHA-512:	A148640AA6F4B4EF3AE37922D8A11F4DEF9ECFD595438B9A36B1BE0810BFB36ABF0E01BEE0AA79712AF0D70CDDCE928C0DF5057C0418C4ED0D733C6193761E82
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....^..........0..........p.............................................. .........................................+....................p...'...........................................P..(...................d................................text....].......^..................`.P`.data........p.......b..............@.`..rdata..p............d..............@.`@.pdata...'...p...(...R..............@.0@.xdata..L,...........z..............@.0@.bss....h.............................`..edata..+...........................@.0@.idata..............................@.0..CRT....X...........................@.@..tls................................@.@..reloc..............................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30632
Entropy (8bit):	6.41055734058478
Encrypted:	false
SSDEEP:	768:lez/Dt36r34krA4eVIS7UAYiSyvAEYeEdSiD:leDE34krA4eVIS7UA7Sy9YLD
MD5:	23F4BECF6A1DF36AEE468BB0949AC2BC
SHA1:	A0E027D79A281981F97343F2D0E7322B9FE9B441
SHA-256:	09C5FAF270FD63BDE6C45CC53B05160262C7CA47D4C37825ED3E15D479DAEE66
SHA-512:	3EE5B3B7583BE1408C0E1E1C885512445A7E47A69FF874508E8F0A00A66A40A0E828CE33E6F30DDC3AC518D69E4BB96C8B36011FB4EDEDF9A9630EF98A14893B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~Zb...b...b...k..`.......`.......n.......j.......a.......a.......`...b...+.......c.......c.......c.......c...Richb...........................PE..d....K.b.........." ... .....8.......................................................F....`..........................................C..L....C..d....p.......`.......N...)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77736
Entropy (8bit):	6.247935524153974
Encrypted:	false
SSDEEP:	1536:C6DucXZAuj19/s+S+pjtk/DDTaVISQwn7SyML:C6DPXSuj19/sT+ppk/XWVISQwneL
MD5:	E137DF498C120D6AC64EA1281BCAB600
SHA1:	B515E09868E9023D43991A05C113B2B662183CFE
SHA-256:	8046BF64E463D5AA38D13525891156131CF997C2E6CDF47527BC352F00F5C90A
SHA-512:	CC2772D282B81873AA7C5CBA5939D232CCEB6BE0908B211EDB18C25A17CBDB5072F102C0D6B7BC9B6B2F1F787B56AB1BC9BE731BB9E98885C17E26A09C2BEB90
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...ry..ry..ry..{.g.ty......py.......y......zy......qy......py..ry...y......uy......sy......sy......sy......sy..Richry..................PE..d....K.b.........." ... .l.......... &.......................................P.......Q....`.............................................P...P........0....... ..l........)...@.........T...............................@............................................text...Rj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97704
Entropy (8bit):	6.173518585387285
Encrypted:	false
SSDEEP:	1536:GzgMWYDOavuvwYXGqijQaIrlIaiP9NbTp9c4L7ZJkyDpIS5Qux7Syce:NFYqDPSQaIrlI/DbLc2tJkyDpIS5QuxZ
MD5:	7F61EACBBBA2ECF6BF4ACF498FA52CE1
SHA1:	3174913F971D031929C310B5E51872597D613606
SHA-256:	85DE6D0B08B5CC1F2C3225C07338C76E1CAB43B4DE66619824F7B06CB2284C9E
SHA-512:	A5F6F830C7A5FADC3349B42DB0F3DA1FDDB160D7E488EA175BF9BE4732A18E277D2978720C0E294107526561A7011FADAB992C555D93E77D4411528E7C4E695A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dQ...?...?...?..}....?..>...?......?..:...?..;...?..<...?..>...?.;w>...?...>...?..2...?..?...?......?..=...?.Rich..?.................PE..d....L.b.........." ... ............................................................4.....`.............................................P....................`.......T...)..............T...............................@...............`............................text...n........................... ..`.rdata...p.......r..................@..@.data...,....@......................@....pdata.......`.......2..............@..@.rsrc................F..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159144
Entropy (8bit):	6.002098953253968
Encrypted:	false
SSDEEP:	3072:UhIDGtzShE3z/JHPUE0uev5J2oE/wu3rE923+nuI5Piev9muxISt710Y:UhIqtzShE3zhvyue5EMnuaF9mu3
MD5:	35F66AD429CD636BCAD858238C596828
SHA1:	AD4534A266F77A9CDCE7B97818531CE20364CB65
SHA-256:	58B772B53BFE898513C0EB264AE4FA47ED3D8F256BC8F70202356D20F9ECB6DC
SHA-512:	1CCA8E6C3A21A8B05CC7518BD62C4E3F57937910F2A310E00F13F60F6A94728EF2004A2F4A3D133755139C3A45B252E6DB76987B6B78BC8269A21AD5890356AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dI...'L..'L..'L.}.L..'L..&M..'L.."M..'L..#M..'L..$M..'L..&M..'Lz\|&M..'L..&Lt.'L)w&M..'L..M..'L..'M..'L...L..'L..%M..'LRich..'L................PE..d....K.b.........." ... ............l...................................................`............................................d...4........`.......P.......D...)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\base_library.zip

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	831926
Entropy (8bit):	5.700496388184754
Encrypted:	false
SSDEEP:	12288:4EHYKPY+WygVqFcIW6A4a2YCdbVwxDfpEn4jSRMNwW:4EHYMVgyLa2JVwxDfpEn4GMNwW
MD5:	6CFF73092664831CA9277C6797993C47
SHA1:	62D17F2BF5785149DF53B5ADBAECC3579A24CFBE
SHA-256:	A8BE7CE0F18A2E14DADB3FE6CC41EC2962DCE172F4CB4DF4535FF0EC47AEE79D
SHA-512:	457211A957656B845AE6E5A34E567C7E33DBB67F6AED9A9C15937F3B39922A2A4BDC70378269C1908FC141EB34ADAA70A0B133BA42BF6498F9E41CE372F3F3CA
Malicious:	false
Preview:	PK..........!................_collections_abc.pyco........k..u.s{.....................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI58402\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer\md.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.82516630102953
Encrypted:	false
SSDEEP:	96:700fK74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFOCQAASmHcX6g8H4ao:QFCk2z1/t12iwU5usJFqCyVcqgg
MD5:	F4F7F634791F26FC62973350D5F89D9A
SHA1:	6BE643BD21C74ED055B5A1B939B1F64B055D4673
SHA-256:	45A043C4B7C6556F2ACFC827F2FF379365088C3479E8EE80C7F0A2CEB858DCC6
SHA-512:	4325807865A76427D05039A2922F853287D420BCEBDA81F63A95BF58502E7DA0489060C4B6F6FFD65AA294E1E1C1F64560ADD5F024355922103C88B2CF1FD79B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................X...................................^............................4...........Rich....................PE..d...c#.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122368
Entropy (8bit):	5.903697891709302
Encrypted:	false
SSDEEP:	1536:5ewkbk74PoxchHGTm/SCtg5MbfFPjPNoSLn2dkp2A/2pQKP:5endPox6HGTOLtg6bfFhDLkkCpQK
MD5:	47EE4516407B6DE6593A4996C3AE35E0
SHA1:	293224606B31E45B10FB67E997420844AE3FE904
SHA-256:	F646C3B72B5E7C085A66B4844B5AD7A9A4511D61B2D74153479B32C7AE0B1A4C
SHA-512:	EFA245C6DB2AEE2D9DB7F99E33339420E54F371A17AF0CF7694DAF51D45AEBFBAC91FC52DDB7C53E9FC73B43C67D8D0A2CAA15104318E392C8987A0DAD647B81
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........VyR.7...7...7...O...7.......7...O...7.......7.......7.......7..JB...7...7..b7......7......7......7......7..Rich.7..........PE..d...b#.g.........." ...).6...........7.......................................0............`......................................... ...d.................................... ......@...................................@............P...............................text...(4.......6.................. ..`.rdata...Y...P...Z...:..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\importlib_metadata-8.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI58402\importlib_metadata-8.0.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI58402\importlib_metadata-8.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	5.006900644756252
Encrypted:	false
SSDEEP:	96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
MD5:	98ABEAACC0E0E4FC385DFF67B607071A
SHA1:	E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
SHA-256:	6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
SHA-512:	F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

C:\Users\user\AppData\Local\Temp\_MEI58402\importlib_metadata-8.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.6307766747793275
Encrypted:	false
SSDEEP:	48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
MD5:	EB513CAFA5226DDA7D54AFDCC9AD8A74
SHA1:	B394C7AEC158350BAF676AE3197BEF4D7158B31C
SHA-256:	0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
SHA-512:	A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
Malicious:	false
Preview:	importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

C:\Users\user\AppData\Local\Temp\_MEI58402\importlib_metadata-8.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.687870576189661
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
MD5:	7D09837492494019EA51F4E97823D79F
SHA1:	7829B4324BB542799494131A270EC3BDAD4DEDEF
SHA-256:	9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
SHA-512:	A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI58402\importlib_metadata-8.0.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI58402\jaraco\text\Lorem ipsum.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (888)
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.226823573023539
Encrypted:	false
SSDEEP:	24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
MD5:	4CE7501F6608F6CE4011D627979E1AE4
SHA1:	78363672264D9CD3F72D5C1D3665E1657B1A5071
SHA-256:	37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
SHA-512:	A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
Malicious:	false
Preview:	Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

C:\Users\user\AppData\Local\Temp\_MEI58402\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3439512
Entropy (8bit):	6.096012359425593
Encrypted:	false
SSDEEP:	98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
MD5:	AB01C808BED8164133E5279595437D3D
SHA1:	0F512756A8DB22576EC2E20CF0CAFEC7786FB12B
SHA-256:	9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
SHA-512:	4043CDA02F6950ABDC47413CFD8A0BA5C462F16BCD4F339F9F5A690823F4D0916478CAB5CAE81A3D5B03A8A196E17A716B06AFEE3F92DEC3102E3BBC674774F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R.m.R.m.R.m.[...@.m.0.l.P.m.0.h.^.m.0.i.Z.m.0.n.V.m.R.l..m..l.Y.m...n.O.m...i.+.m...m.S.m....S.m...o.S.m.RichR.m.........................PE..d...`.0b.........." ......$...................................................5......4...`..........................................x/..h...:4.@....p4.\|....p2.8....\4.......4..O....,.8...........................`.,.@............04..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......p2.......1.............@..@.idata..^#...04..$....3.............@..@.00cfg..u....`4.......3.............@..@.rsrc...\|....p4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	698784
Entropy (8bit):	5.533720236597082
Encrypted:	false
SSDEEP:	12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
MD5:	DE72697933D7673279FB85FD48D1A4DD
SHA1:	085FD4C6FB6D89FFCC9B2741947B74F0766FC383
SHA-256:	ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
SHA-512:	0FD4678C65DA181D7C27B19056D5AB0E5DD0E9714E9606E524CDAD9E46EC4D0B35FE22D594282309F718B30E065F6896674D3EDCE6B3B0C8EB637A3680715C2C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.T.?.:.?.:.?.:.6f..3.:.]f;.=.:..l;.=.:.]f?.3.:.]f>.7.:.]f9.;.:..g;.<.:.?.;...:..g>...:..g:.>.:..g.>.:..g8.>.:.Rich?.:.........PE..d.....0b.........." .....<...T......<................................................[....`.........................................00...N..HE..........s.......\|M..............h... ...8...............................@............0..H............................text....:.......<.................. ..`.rdata..:....P...0...@..............@..@.data...AM.......D...p..............@....pdata..dV.......X..................@..@.idata..PW...0...X..................@..@.00cfg..u............d..............@..@.rsrc...s............f..............@..@.reloc..a............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	198568
Entropy (8bit):	6.360283939217406
Encrypted:	false
SSDEEP:	3072:rkPTemtXBsiLC/QOSL6XZIMuPbBV3Dy9zeL9ef93d1BVdOd8dVyio0OwUpz1RPoi:AKmVG/pxIMuPbBFEFDBwpp2W
MD5:	6BC89EBC4014A8DB39E468F54AAAFA5E
SHA1:	68D04E760365F18B20F50A78C60CCFDE52F7FCD8
SHA-256:	DBE6E7BE3A7418811BD5987B0766D8D660190D867CD42F8ED79E70D868E8AA43
SHA-512:	B7A6A383EB131DEB83EEE7CC134307F8545FB7D043130777A8A9A37311B64342E5A774898EDD73D80230AB871C4D0AA0B776187FA4EDEC0CCDE5B9486DBAA626
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...........6...k.....k.....k.....k.....o............\|.o.....o.....o.Z...o.....Rich..................PE..d....K.b.........." ... ............0................................................0....`.........................................`...P................................)..........@6..T............................5..@............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\python310.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4493736
Entropy (8bit):	6.465157771728023
Encrypted:	false
SSDEEP:	49152:5vL1txd/8sCmiAiPw+RxtLzli0Im3wOc+28Ivu31WfbF9PtF+FNDHaSclAaBlh7y:Dw7Ad07RmodacSeSHCMTbSp4PS
MD5:	C80B5CB43E5FE7948C3562C1FFF1254E
SHA1:	F73CB1FB9445C96ECD56B984A1822E502E71AB9D
SHA-256:	058925E4BBFCB460A3C00EC824B8390583BAEF0C780A7C7FF01D43D9EEC45F20
SHA-512:	FAA97A9D5D2A0BF78123F19F8657C24921B907268938C26F79E1DF6D667F7BEE564259A3A11022E8629996406CDA9FA00434BB2B1DE3E10B9BDDC59708DBAD81
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.o...o...o.......m.......b.......c.......g.......k...f.`.u......f...o...3..............n.......n.......n...Richo...................PE..d....K.b.........." ... ..#...!.....\|!........................................E.....{.D...`..........................................G=.......>.\|.....E.......B......hD..)....E..t...Q%.T...........................`P%.@.............#.0............................text.....#.......#................. ..`.rdata...\....#..^....#.............@..@.data... ....0>.......>.............@....pdata........B.. ....A.............@..@PyRuntim`.....D.......C.............@....rsrc.........E.......C.............@..@.reloc...t....E..v....C.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\select.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29096
Entropy (8bit):	6.4767692602677815
Encrypted:	false
SSDEEP:	384:rPxHeWt+twhCBsHqF2BMXR6VIS7GuIYiSy1pCQkyw24i/8E9VFL2Ut8JU:ZeS+twhC6HqwmYVIS7GjYiSyv7VeEdH
MD5:	ADC412384B7E1254D11E62E451DEF8E9
SHA1:	04E6DFF4A65234406B9BC9D9F2DCFE8E30481829
SHA-256:	68B80009AB656FFE811D680585FAC3D4F9C1B45F29D48C67EA2B3580EC4D86A1
SHA-512:	F250F1236882668B2686BD42E1C334C60DA7ABEC3A208EBEBDEE84A74D7C4C6B1BC79EED7241BC7012E4EF70A6651A32AA00E32A83F402475B479633581E0B07
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{?t..Q'..Q'..Q'.b.'..Q'.`P&..Q'.`T&..Q'.`U&..Q'.`R&..Q'.`P&..Q'..P'..Q'5hP&..Q'.`\&..Q'.`Q&..Q'.`.'..Q'.`S&..Q'Rich..Q'........................PE..d....K.b.........." ... .....2......................................................l.....`..........................................@..L....@..x....p.......`.......H...)......L....3..T............................2..@............0...............................text............................... ..`.rdata..H....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1445800
Entropy (8bit):	6.579172773828651
Encrypted:	false
SSDEEP:	24576:tU3g/eNVQHzcayG7b99ZSYR4eXj98nXMuVp+qbLKeq98srCIS:ck3hbEAp8X9Vp+2q2gI
MD5:	926DC90BD9FAF4EFE1700564AA2A1700
SHA1:	763E5AF4BE07444395C2AB11550C70EE59284E6D
SHA-256:	50825EA8B431D86EC228D9FA6B643E2C70044C709F5D9471D779BE63FF18BCD0
SHA-512:	A8703FF97243AA3BC877F71C0514B47677B48834A0F2FEE54E203C0889A79CE37C648243DBFE2EE9E1573B3CA4D49C334E9BFE62541653125861A5398E2FE556
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|{.............e.......g.......g.......g.......g......Po...............g.......g.......g.....g......Rich............PE..d....L.b.........." ... ..................................................... .......`....`..............................................!...................0...........)......\|...Pg..T............................f..@............ ..(............................text............................... ..`.rdata..D.... ......................@..@.data...0A.......8..................@....pdata.......0......................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1121192
Entropy (8bit):	5.384501252071814
Encrypted:	false
SSDEEP:	12288:bMYYMmuZ63NoQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+uz9O:AYYuXZV0m8wMMREtV6Vo4uYz9O
MD5:	102BBBB1F33CE7C007AAC08FE0A1A97E
SHA1:	9A8601BEA3E7D4C2FA6394611611CDA4FC76E219
SHA-256:	2CF6C5DEA30BB0584991B2065C052C22D258B6E15384447DCEA193FDCAC5F758
SHA-512:	A07731F314E73F7A9EA73576A89CCB8A0E55E53F9B5B82F53121B97B1814D905B17A2DA9BD2EDA9F9354FC3F15E3DEA7A613D7C9BC98C36BBA653743B24DFC32
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(..F...F...F......F..G...F..C...F..B...F..E...F...G...F.C.G...F...G...F...K...F...F...F.......F...D...F.Rich..F.........................PE..d....K.b.........." ... .B...........*.......................................@......Y.....`.............................................X...(........ ...................)...0......@b..T............................a..@............`..x............................text....A.......B.................. ..`.rdata......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI58402\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	4.734800858158476
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	23'380'969 bytes
MD5:	719dcf184f232c140a40a69f05ae2ae7
SHA1:	ac1e40daf79114c78ca756f2cfe5619cd2804cc2
SHA256:	5b5856719e14b1dcf6297e51e69b147263a72203e2f7bc5d938ae41f01312270
SHA512:	36ec8a14ee9f579f221662f29f08882f6f9dc59637100a99bc782cddbdf3aa1c27925ca5ff94e7b3e52e092a789104713e781226050466841d01cc04960bf2a5
SSDEEP:	393216:mSatYjL2Vmd6mOc/eE7G99XtIqcjhA3QV:mSaijyVmdUuYt7+N
TLSH:	40373341535005D6F7EA4833C8A3861AEA65FC661FA7C78F876CC2201EB72E65C76F60
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'X.8c9.kc9.kc9.kwR.jh9.kwR.jd9.kwR.j.9.k.V#kg9.k1L.jE9.k1L.jr9.k1L.jj9.kwR.jh9.kc9.k.9.k.L.jp9.k.L.jb9.kRichc9.k...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000a8c8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67463B7F [Tue Nov 26 21:19:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	c5640c7a22008f949f9bc94a27623f95

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F907C4F6BCCh
dec eax
add esp, 28h
jmp 00007F907C4F654Fh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001A8D3h]
dec eax
mov ecx, ebx
call dword ptr [0001A8C2h]
call dword ptr [0001A83Ch]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0001A8B8h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [0001A8ACh]
test eax, eax
je 00007F907C4F66D9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [0003B6DAh]
call 00007F907C4F689Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [0003B7C1h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [0003B751h], eax
dec eax
mov eax, dword ptr [0003B7AAh]
dec eax
mov dword ptr [0003B61Bh], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [0003B71Fh], eax
mov dword ptr [0003B5F5h], C0000409h
mov dword ptr [0003B5EFh], 00000001h
mov dword ptr [0003B5F9h], 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x35b18	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4b000	0x5f4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x48000	0x1de8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4c000	0x748	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x33920	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x33940	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x25000	0x3e8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x235d0	0x23600	050ad070d74c0ab2baca6ee9c3b61b5d	False	0.5690426236749117	data	6.471510843579973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x25000	0x11898	0x11a00	754fb7273f6f90d5ec572898e7d5a31b	False	0.4956504875886525	PGP symmetric key encrypted data - Plaintext or unencrypted data	5.711783723135146	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x10398	0xc00	b88590ca230f956ba7b5bffcbee69475	False	0.138671875	data	1.8589891596226968	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x48000	0x1de8	0x1e00	626ab1518bc3687e03dacd39bbfde649	False	0.4921875	data	5.392285019157171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x4a000	0xf4	0x200	3fa4bb815d2865eb13ca6b140ccf210f	False	0.302734375	data	1.9616758456060694	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x4b000	0x5f4	0x600	ba10337ed2e1a0f4fc239de712765237	False	0.4615885416666667	data	5.420178602448388	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4c000	0x748	0x800	ab10229e6319ea5b4dde9f2a80ec60f0	False	0.55322265625	data	5.222259043944798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4b058	0x59a	XML 1.0 document, ASCII text, with CRLF line terminators			0.4497907949790795

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, FlushFileBuffers, GetCurrentDirectoryW, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetEnvironmentStringsW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, GetCommandLineW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, RaiseException, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindClose, FindFirstFileExW, FindNextFileW, SetStdHandle, SetConsoleCtrlHandler, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2024 08:26:06.908411980 CET	49700	443	192.168.2.7	172.67.142.108
Nov 27, 2024 08:26:06.908449888 CET	443	49700	172.67.142.108	192.168.2.7
Nov 27, 2024 08:26:06.908529043 CET	49700	443	192.168.2.7	172.67.142.108
Nov 27, 2024 08:26:06.909729004 CET	49700	443	192.168.2.7	172.67.142.108
Nov 27, 2024 08:26:06.909742117 CET	443	49700	172.67.142.108	192.168.2.7
Nov 27, 2024 08:26:08.128799915 CET	443	49700	172.67.142.108	192.168.2.7
Nov 27, 2024 08:26:08.129573107 CET	49700	443	192.168.2.7	172.67.142.108
Nov 27, 2024 08:26:08.129602909 CET	443	49700	172.67.142.108	192.168.2.7
Nov 27, 2024 08:26:08.130948067 CET	443	49700	172.67.142.108	192.168.2.7
Nov 27, 2024 08:26:08.131017923 CET	49700	443	192.168.2.7	172.67.142.108
Nov 27, 2024 08:26:08.131813049 CET	49700	443	192.168.2.7	172.67.142.108
Nov 27, 2024 08:26:08.131972075 CET	443	49700	172.67.142.108	192.168.2.7
Nov 27, 2024 08:26:08.132021904 CET	49700	443	192.168.2.7	172.67.142.108
Nov 27, 2024 08:26:08.132072926 CET	49700	443	192.168.2.7	172.67.142.108

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2024 08:26:06.551801920 CET	49232	53	192.168.2.7	1.1.1.1
Nov 27, 2024 08:26:06.904700041 CET	53	49232	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 27, 2024 08:26:06.551801920 CET	192.168.2.7	1.1.1.1	0xa3e4	Standard query (0)	script.irisstealer.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 27, 2024 08:26:06.904700041 CET	1.1.1.1	192.168.2.7	0xa3e4	No error (0)	script.irisstealer.xyz		172.67.142.108	A (IP address)	IN (0x0001)	false
Nov 27, 2024 08:26:06.904700041 CET	1.1.1.1	192.168.2.7	0xa3e4	No error (0)	script.irisstealer.xyz		104.21.71.25	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	02:26:01
Start date:	27/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff73a540000
File size:	23'380'969 bytes
MD5 hash:	719DCF184F232C140A40A69F05AE2AE7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:26:03
Start date:	27/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff73a540000
File size:	23'380'969 bytes
MD5 hash:	719DCF184F232C140A40A69F05AE2AE7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:26:04
Start date:	27/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff64f5d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:26:04
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	57

Executed Functions

Function 00007FF73A560010 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 280
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF73A56005A

Part of subcall function 00007FF73A55F9B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55F9C4

_get_daylight.LIBCMT ref: 00007FF73A560049

Part of subcall function 00007FF73A55FA10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55FA24

_get_daylight.LIBCMT ref: 00007FF73A5602D2
_get_daylight.LIBCMT ref: 00007FF73A5602E3
_get_daylight.LIBCMT ref: 00007FF73A5602F4
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73A560500), ref: 00007FF73A56031B

Strings

Eastern Summer Time, xrefs: 00007FF73A5603D9
Eastern Standard Time, xrefs: 00007FF73A5603C1

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 435049134-239921721
Opcode ID: 58cdc8587cf83bd56faf21a3990621100b965ba913e33c42328a1e7fc78fe5cb
Instruction ID: 9afc6d2a4c32e042264899bb8745342daa189568591c2ccfb954c666d03218e3
Opcode Fuzzy Hash: 58cdc8587cf83bd56faf21a3990621100b965ba913e33c42328a1e7fc78fe5cb
Instruction Fuzzy Hash: E9B1F66AB0861266FB20FF22D4425B9E760BF86794FC09171FE4E47A95DF3CE441A720

Function 00007FF73A5462D0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF73A54629D), ref: 00007FF73A54636A

Part of subcall function 00007FF73A5464E0: GetEnvironmentVariableW.KERNEL32(00007FF73A543589), ref: 00007FF73A54651A
Part of subcall function 00007FF73A5464E0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF73A546537

Part of subcall function 00007FF73A551D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A551D65

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF73A546421

Part of subcall function 00007FF73A542760: MessageBoxW.USER32 ref: 00007FF73A542831

Strings

_MEI%d, xrefs: 00007FF73A546378
TMP, xrefs: 00007FF73A54632E
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF73A546348
TMP, xrefs: 00007FF73A546308, 00007FF73A5463C9, 00007FF73A546457

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 8572a28abcf4b6f779757657c908c94eca5ae1084b8f05d3920f523161e2d6b8
Instruction ID: a062384e7ce914eeb548a1a24e4a5db37c1f9d230433b68c505680d3dcd9babf
Opcode Fuzzy Hash: 8572a28abcf4b6f779757657c908c94eca5ae1084b8f05d3920f523161e2d6b8
Instruction Fuzzy Hash: 2851B059B0966370FE54B732A5572B9E3815F47BC0FE410B1EC0E8BB96ED2CE0056320

Function 00007FF73A5602A4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF73A5602D2

Part of subcall function 00007FF73A55FA10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55FA24

_get_daylight.LIBCMT ref: 00007FF73A5602E3

Part of subcall function 00007FF73A55F9B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55F9C4

_get_daylight.LIBCMT ref: 00007FF73A5602F4

Part of subcall function 00007FF73A55F9E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55F9F4

Part of subcall function 00007FF73A5559CC: RtlFreeHeap.NTDLL ref: 00007FF73A5559E2

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73A560500), ref: 00007FF73A56031B

Strings

Eastern Summer Time, xrefs: 00007FF73A5603D9
Eastern Standard Time, xrefs: 00007FF73A5603C1

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$FreeHeapInformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 428190724-239921721
Opcode ID: 55e869582554ddb5549c8990e86a244669a00d33a611132a5f4e4556225478bd
Instruction ID: ab9b7be5487113c7537c799e0e641cab1a04bf5b95333a6aced6b76849e5839f
Opcode Fuzzy Hash: 55e869582554ddb5549c8990e86a244669a00d33a611132a5f4e4556225478bd
Instruction Fuzzy Hash: 3261947AB08652A6F720FF21E4825B9E760BF46784FC05175FA4E43AA5DF3CE400A760

Function 00007FF73A5417A0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF73A54184C
_fread_nolock.LIBCMT ref: 00007FF73A5418FE

Part of subcall function 00007FF73A54C954: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54C968

Part of subcall function 00007FF73A542760: MessageBoxW.USER32 ref: 00007FF73A542831

Strings

MEI, xrefs: 00007FF73A5417DF
Failed to read cookie!, xrefs: 00007FF73A541857
fread, xrefs: 00007FF73A54185E
malloc, xrefs: 00007FF73A5418DA
Could not read full TOC!, xrefs: 00007FF73A541909
Could not allocate buffer for TOC!, xrefs: 00007FF73A5418D3
Failed to seek to cookie position!, xrefs: 00007FF73A54181F
Error on file., xrefs: 00007FF73A54192D
fseek, xrefs: 00007FF73A541826
Cannot read Table of Contents., xrefs: 00007FF73A541985

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: 320f3964a2904e40c61c5f8f551b81845132cf9ff697b3714dfa5a7d511f77b3
Instruction ID: da3c6c5bbef71cbee0f478753b70c49d9e5bc0510db7f41ea9f9a8cb64a76f19
Opcode Fuzzy Hash: 320f3964a2904e40c61c5f8f551b81845132cf9ff697b3714dfa5a7d511f77b3
Instruction Fuzzy Hash: 7A51E4B6A09A12A6FB54EF25D45217CB3A0FF8AB48BE09175D90D83399DF3CE404D760

Function 00007FF73A541440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fwrite, xrefs: 00007FF73A5415DC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF73A5415E5
fopen, xrefs: 00007FF73A541491
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF73A5414F9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF73A5414CA
fread, xrefs: 00007FF73A5415EC
malloc, xrefs: 00007FF73A541560
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF73A5415D5
Failed to extract %s: failed to open target file!, xrefs: 00007FF73A54148A
fseek, xrefs: 00007FF73A541500
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF73A541559

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: a6ee990388ec5f0ffcb7c3e82e3686e86aa2c282ca6a00539b77d1faa1e73c5e
Instruction ID: f33d396d1d266f5719b1b9db27fa1a6419832e53e1bbc670630311b6975e152e
Opcode Fuzzy Hash: a6ee990388ec5f0ffcb7c3e82e3686e86aa2c282ca6a00539b77d1faa1e73c5e
Instruction Fuzzy Hash: CA51B169B08662A1FA10FB12E4066B9E350BF43BD4FE44571DE1D07BA5EE3CE504E720

Function 00007FF73A547300 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF73A5463AA,?,00007FF73A54629D), ref: 00007FF73A547340
OpenProcessToken.ADVAPI32(?,00007FF73A54629D), ref: 00007FF73A547351
GetTokenInformation.KERNELBASE(?,00007FF73A54629D(TokenIntegrityLevel)), ref: 00007FF73A547373
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF73A54737D
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel), ref: 00007FF73A5473BA
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF73A5473CC
CloseHandle.KERNEL32(?,00007FF73A54629D), ref: 00007FF73A5473E4
LocalFree.KERNEL32(?,00007FF73A54629D), ref: 00007FF73A547416
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF73A54743D
CreateDirectoryW.KERNELBASE(?,00007FF73A54629D), ref: 00007FF73A54744E

Strings

S-1-3-4, xrefs: 00007FF73A5473EF
D:(A;;FA;;;%s), xrefs: 00007FF73A5473F9

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: c013547ab4f6b52ace7e36fbdad21f4822d789d754ca205bf3e0b472ed91f04a
Instruction ID: 3ec0b1d57b5b04a472498dc25ac5b728d9da33855eff2938fb07988bf022f145
Opcode Fuzzy Hash: c013547ab4f6b52ace7e36fbdad21f4822d789d754ca205bf3e0b472ed91f04a
Instruction Fuzzy Hash: B241D53561878292FB50AF11F4522BAB360FF867A0F901231EA5E436E4DF3CD408D710

Function 00007FF73A560F7C Relevance: 13.8, APIs: 9, Instructions: 273
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73A560CAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A560CED
Part of subcall function 00007FF73A560CAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A560D6D
Part of subcall function 00007FF73A560CAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A560DC1
Part of subcall function 00007FF73A560CAC: _get_daylight.LIBCMT ref: 00007FF73A560E19

CreateFileW.KERNELBASE ref: 00007FF73A561082
CreateFileW.KERNEL32 ref: 00007FF73A5610D2
GetLastError.KERNEL32 ref: 00007FF73A561102
GetFileType.KERNELBASE ref: 00007FF73A561117
GetLastError.KERNEL32 ref: 00007FF73A561121
CloseHandle.KERNEL32 ref: 00007FF73A561154
CloseHandle.KERNEL32 ref: 00007FF73A5612AF
CreateFileW.KERNEL32 ref: 00007FF73A5612E4
GetLastError.KERNEL32 ref: 00007FF73A5612F3

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: d121c7e434188e1b59c11ae7c5eb2a34e011b9b37a129bdee774847c0c4b5b89
Instruction ID: c2e9bef5e8f7cfed8cbf2f6e2a41878d0cc8809ad7bd505aaac40167fd3e0c39
Opcode Fuzzy Hash: d121c7e434188e1b59c11ae7c5eb2a34e011b9b37a129bdee774847c0c4b5b89
Instruction Fuzzy Hash: B1C1D13BB28A4296FB10DF68C4821BC7761FB4AB98B905265DE5E877E4CF38D051D310

Function 00007FF73A541000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73A543A40: GetModuleFileNameW.KERNEL32(?,00007FF73A54353B), ref: 00007FF73A543A71

SetDllDirectoryW.KERNEL32 ref: 00007FF73A543747

Part of subcall function 00007FF73A5464E0: GetEnvironmentVariableW.KERNEL32(00007FF73A543589), ref: 00007FF73A54651A
Part of subcall function 00007FF73A5464E0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF73A546537

Strings

Failed to convert DLL search path!, xrefs: 00007FF73A54372F
_MEIPASS2, xrefs: 00007FF73A543575, 00007FF73A5435DE, 00007FF73A54388B, 00007FF73A54389B
MEI, xrefs: 00007FF73A543689
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF73A543630
_PYI_ONEDIR_MODE, xrefs: 00007FF73A54359E, 00007FF73A5435C9
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF73A5436CE

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 35b6a1ab1573045e90b06303ce958787798ac9f0c96f516a7dc4b0e6b240bfd8
Instruction ID: 436599741f618e4a96b5598025bec94db2198157b7d6499c8a65d6d5a917189a
Opcode Fuzzy Hash: 35b6a1ab1573045e90b06303ce958787798ac9f0c96f516a7dc4b0e6b240bfd8
Instruction Fuzzy Hash: 61B1E969A1C6A371FA24BB21D4532FDE350BF52794FE00071EA4D477A6EE2CE605E720

Function 00007FF73A541050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF73A5410F1
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF73A54111F
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF73A5410B4
malloc, xrefs: 00007FF73A5410F8, 00007FF73A541126
1.2.11, xrefs: 00007FF73A54107E
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF73A541249

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Message
String ID: 1.2.11$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1060636955
Opcode ID: fcfe88969c29fd5022b5f868d2bb7b0478a7fba7381f489e9e563d5b4b2c0f76
Instruction ID: 7b3d111833752b22a4c4219404a1346f1b1e53e58f8a62bc509ea3a5af0cfe67
Opcode Fuzzy Hash: fcfe88969c29fd5022b5f868d2bb7b0478a7fba7381f489e9e563d5b4b2c0f76
Instruction Fuzzy Hash: B651086AA0C662A5F660BB12E4423B9E391FB86794FE44171EE4D87795EF3CE404E310

Function 00007FF73A546AC0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73A547490: MultiByteToWideChar.KERNEL32 ref: 00007FF73A5474CA

Part of subcall function 00007FF73A5529DC: SetConsoleCtrlHandler.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF73A554CC0), ref: 00007FF73A552A49

Part of subcall function 00007FF73A5529DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF73A554CC0), ref: 00007FF73A552A64

GetStartupInfoW.KERNEL32 ref: 00007FF73A546B47

Part of subcall function 00007FF73A554C20: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A554C34

Part of subcall function 00007FF73A552590: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A5525F7

GetCommandLineW.KERNEL32 ref: 00007FF73A546BCF
CreateProcessW.KERNELBASE ref: 00007FF73A546C11
WaitForSingleObject.KERNEL32 ref: 00007FF73A546C25
GetExitCodeProcess.KERNELBASE ref: 00007FF73A546C35

Strings

CreateProcessW, xrefs: 00007FF73A546C48
Error creating child process!, xrefs: 00007FF73A546C41

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlErrorExitHandlerInfoLastLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 1742298069-3524285272
Opcode ID: 34d3020eba07ba2d97dcf2fb01128670c0ea838258e1194f51c279e9e3a7fdcb
Instruction ID: 250e5b70dcaa697d46ab039b3a0e7d9c9ceb7f0b366f55586cd3e94f7cfa0f18
Opcode Fuzzy Hash: 34d3020eba07ba2d97dcf2fb01128670c0ea838258e1194f51c279e9e3a7fdcb
Instruction Fuzzy Hash: 90418276A0868292FA14FB60F4522AEF3A0FF96340F900575E68E07B96EF7CD0449B10

Function 00007FF73A556408 Relevance: 10.8, APIs: 7, Instructions: 291
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55683E

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ebd7444367072219966275c470e2b77938e3cc8ba9916451fa94e3284f505fc6
Instruction ID: a32e1a26c7be86980837f0b10651d4f3313a4b052090f05af1e5fb793b7bb5f4
Opcode Fuzzy Hash: ebd7444367072219966275c470e2b77938e3cc8ba9916451fa94e3284f505fc6
Instruction Fuzzy Hash: EBC1E6AAA0D687A5FA606F14904227DFB91EF42B80FD90171E94F07B91CF7CE455E360

Function 00007FF73A557748 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55778A
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73A557707,?,?,?,00007FF73A55136B), ref: 00007FF73A557848
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73A557707,?,?,?,00007FF73A55136B), ref: 00007FF73A5578D2

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: d06b69eb54db138b2fabc1b490ae97352d3858303d3e99d72cf8a1c469c90f76
Instruction ID: 6b87da44891e170e7a592474d1bfca17d5c981afced692f2a33df60f0cfd2ebd
Opcode Fuzzy Hash: d06b69eb54db138b2fabc1b490ae97352d3858303d3e99d72cf8a1c469c90f76
Instruction Fuzzy Hash: ED81A3AAE1861269FB10BF6594422BDA760BB47B94FC405B1ED0F53692DF3CE445E330

Function 00007FF73A54A754 Relevance: 7.6, APIs: 5, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF73A54A763

Part of subcall function 00007FF73A54ABB4: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF73A54ABD6

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF73A54A778
__scrt_release_startup_lock.LIBCMT ref: 00007FF73A54A7E6
__scrt_get_show_window_mode.LIBCMT ref: 00007FF73A54A839
__scrt_is_managed_app.LIBCMT ref: 00007FF73A54A85C

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 4144305933-0
Opcode ID: 905a242882acf3dcbb492acab9fca3e2a56a9f2e6c63301775e57231c58ea269
Instruction ID: bd545f7bb526a20ed96e625335c0a517cba0629d55836f576b9d78e4e720335f
Opcode Fuzzy Hash: 905a242882acf3dcbb492acab9fca3e2a56a9f2e6c63301775e57231c58ea269
Instruction Fuzzy Hash: 0631652DE4C123B1FAA4BB6194533B9A391AF53745FE440B4E74E076D3DE1CA405A330

Function 00007FF73A55A16C Relevance: 6.2, APIs: 4, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF73A55A259
_get_daylight.LIBCMT ref: 00007FF73A55A26A
_get_daylight.LIBCMT ref: 00007FF73A55A27B
_isindst.LIBCMT ref: 00007FF73A55A341

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 1e89f32c8738a6adba9b4243f60db3606398dcc5d4dd087393c0fa2c4f991abe
Instruction ID: 8dad975802bea6b85bb474bcc262a36a61e8aa1e663097d0f0334e448f1a96d1
Opcode Fuzzy Hash: 1e89f32c8738a6adba9b4243f60db3606398dcc5d4dd087393c0fa2c4f991abe
Instruction Fuzzy Hash: 365127B6F041129AFF18EB68E84A1BCA761AB0239CF950075EF0F17AD5DB3CA4059710

Function 00007FF73A550030 Relevance: 6.1, APIs: 4, Instructions: 119
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FF73A550063
GetFileInformationByHandle.KERNELBASE ref: 00007FF73A5500C5
GetLastError.KERNEL32 ref: 00007FF73A550156
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF73A54FF73), ref: 00007FF73A5501A2

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 6899de51ad08ef7ac92c084c14726983b8b4bc0ee654778090e53e065c03d277
Instruction ID: 5ea079f0c5cca0106cdb2c08cbac64420c81bde3e38db3ddf3d1bc7a552b126e
Opcode Fuzzy Hash: 6899de51ad08ef7ac92c084c14726983b8b4bc0ee654778090e53e065c03d277
Instruction Fuzzy Hash: 9751B167E086019AFB10EFB0D8423BDB3A1AB46B58F944034EE0E5B799DF38D4859721

Function 00007FF73A54FEE4 Relevance: 4.6, APIs: 3, Instructions: 92fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54FF15

Part of subcall function 00007FF73A5504B4: GetDriveTypeW.KERNEL32 ref: 00007FF73A550578

CreateFileW.KERNELBASE ref: 00007FF73A54FF53
CloseHandle.KERNEL32 ref: 00007FF73A54FF91

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: CloseCreateDriveFileHandleType_invalid_parameter_noinfo
String ID:
API String ID: 2907017715-0
Opcode ID: 2e9f51862bea0f784220eb21cb60309d8ddf4c05621d68dd0f99bab33618c716
Instruction ID: 0e5a2275d76f517f160d9f548ae4bdc2a5f6681e746989435ae4a6a88fddfed5
Opcode Fuzzy Hash: 2e9f51862bea0f784220eb21cb60309d8ddf4c05621d68dd0f99bab33618c716
Instruction Fuzzy Hash: DD310476D18791A7F610AF24A501279B750FB86BA4F504330FAAD43AD2DF3CE1A4D750

Function 00007FF73A554394 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF73A554393), ref: 00007FF73A5543BD
TerminateProcess.KERNEL32(?,?,?,00007FF73A554393), ref: 00007FF73A5543C8
ExitProcess.KERNEL32 ref: 00007FF73A5543D7

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f5bd35b994d705466abf85fcadaa355dadbc0a36878a45ce859ff20c5e8e7d7d
Instruction ID: c9d919335c300bf5fb81b6d1206263cf3dce7eff6c88cf325bbe354f7fcd5f92
Opcode Fuzzy Hash: f5bd35b994d705466abf85fcadaa355dadbc0a36878a45ce859ff20c5e8e7d7d
Instruction Fuzzy Hash: B7E04868F5570163FF147B31A89727953625F56741F5165B8E80F42372CD3DE4889320

Function 00007FF73A5597A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF73A5597C3

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FF73A5597A9, 00007FF73A5597BC

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: try_get_function
String ID: AppPolicyGetProcessTerminationMethod
API String ID: 2742660187-2031265017
Opcode ID: 7c477a6e0260293fc4875704b17d5099e40d7a8fa35e17519be663d6003857eb
Instruction ID: 225b0a1d4ea472cc483d381da396a98f5c2dc9c24950d300d9fccaffb2930028
Opcode Fuzzy Hash: 7c477a6e0260293fc4875704b17d5099e40d7a8fa35e17519be663d6003857eb
Instruction Fuzzy Hash: F9E04899F05506A1FE55AB7168061B0A210DF1A770FC813B2ED3D063E09E6CDDD59250

Function 00007FF73A54C980 Relevance: 3.2, APIs: 2, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54C9BC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54CAB9

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 418abc046f0238a7e4161840f51ccb75892871292d6ebbe86ace378d7f50b21f
Instruction ID: 7eb9cf2724376d746895e4645a81f577bc3d738a8edbcf3c8c86afa7cfb91c71
Opcode Fuzzy Hash: 418abc046f0238a7e4161840f51ccb75892871292d6ebbe86ace378d7f50b21f
Instruction Fuzzy Hash: E2515B69B0826165FA24FE37940A676E791BFC2BB4FA44270DD6D077C5CE3CE401B620

Function 00007FF73A5501D8 Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73A5500ED), ref: 00007FF73A55020C
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73A5500ED), ref: 00007FF73A550220

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 0eaf3b3217e949b2d1843143c589130ed5bb45f9e3ac99212c08a79cd93a5246
Instruction ID: 9799daa9ffa364a0d08c06b8cdb7828b3b10bd0ee16e251631cb3cc3135b9452
Opcode Fuzzy Hash: 0eaf3b3217e949b2d1843143c589130ed5bb45f9e3ac99212c08a79cd93a5246
Instruction Fuzzy Hash: 1B11C1B6F1861299FF54AF61D4030BD77B1AB05728B800275FE2E55AD8EF38E090E720

Function 00007FF73A556ABC Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00007FF73A5577DF,?,?,?,?,?,?,?,?,?,?,?,00007FF73A557707), ref: 00007FF73A556B00
GetLastError.KERNEL32(?,?,?,00007FF73A5577DF,?,?,?,?,?,?,?,?,?,?,?,00007FF73A557707), ref: 00007FF73A556B0A

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 1070729c18fb5a550bb7979bd9dd777fb7470f3e740498ab44d3ee6d69d9d9f5
Instruction ID: e1a612d6df351d775876b522b43e0d4112d38a2820550f0a984705394181bf6a
Opcode Fuzzy Hash: 1070729c18fb5a550bb7979bd9dd777fb7470f3e740498ab44d3ee6d69d9d9f5
Instruction Fuzzy Hash: 8401C2A5B18A82A1FE106B25E842079B351AB46BF0F985371F93E07BE5DE3CD455A310

Function 00007FF73A55201C Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73A551E99), ref: 00007FF73A55203F
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73A551E99), ref: 00007FF73A552055

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 9bba130d84977ab18fcd365510e816d73f80cae2fb6a2fa4e9637845de17096b
Instruction ID: 4fa7860328032f2d25a0b129dc094a3d3373fe9abee66c79ffbc2079572bdfe5
Opcode Fuzzy Hash: 9bba130d84977ab18fcd365510e816d73f80cae2fb6a2fa4e9637845de17096b
Instruction Fuzzy Hash: 9B01827550C65192FB54AF15E40213EF7A0FB86761FA00275F7AE015E8EB3DD050EB10

Function 00007FF73A552BB8 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF73A552BBC
GetLastError.KERNEL32 ref: 00007FF73A552BC6

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: a110f7d1b7ec296afe3bcd74a18c0b5b99b74e1faa9278b797ccf47ad87a1743
Instruction ID: 9b23a945efd6fd9330819ef6e8a9c96a58b1b88dca0fe4449039858e1a906359
Opcode Fuzzy Hash: a110f7d1b7ec296afe3bcd74a18c0b5b99b74e1faa9278b797ccf47ad87a1743
Instruction Fuzzy Hash: 34D0C958F5D542A1FA283BB5084727892901F46735FE016B0E41A811E1DE1CA08A2731

Function 00007FF73A551D84 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF73A551D88
GetLastError.KERNEL32 ref: 00007FF73A551D92

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 258a339611dc062ead2a4e41dd68cb13de698b6b72ff6dd1ba0822b57a256d12
Instruction ID: 93da5140eca9cab12060439a993bbf5c565c429fdf8f55aaf613f9429ca55657
Opcode Fuzzy Hash: 258a339611dc062ead2a4e41dd68cb13de698b6b72ff6dd1ba0822b57a256d12
Instruction Fuzzy Hash: 51D0A928E4C003A6FA503BB0080703892802F42B20FE402B0E01A801E1DE1CA0892A31

Function 00007FF73A555B24 Relevance: 2.6, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF73A555A57,?,?,00000000,00007FF73A555AFF,?,?,?,?,?,?,00007FF73A54C892), ref: 00007FF73A555B8A
GetLastError.KERNEL32(?,?,?,00007FF73A555A57,?,?,00000000,00007FF73A555AFF,?,?,?,?,?,?,00007FF73A54C892), ref: 00007FF73A555B94

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 482a02ddfad1f0d1748aaf476af5d25a2817b8fdf229cc618c88afa72f650b78
Instruction ID: 13687537529dc4b2463c7f4f0c3623b46b0aac5c7110169e41fd432f813bcf3d
Opcode Fuzzy Hash: 482a02ddfad1f0d1748aaf476af5d25a2817b8fdf229cc618c88afa72f650b78
Instruction Fuzzy Hash: C811B4A8B0C24261FE647B60949B37C93825F467B0FD406B5FA2F4A2C2DE6CE444A320

Function 00007FF73A546780 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A547490: MultiByteToWideChar.KERNEL32 ref: 00007FF73A5474CA

_findclose.LIBCMT ref: 00007FF73A5469D9

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: 9b919f4984b625d952ac1402723aa15eef98a3d63cb4fef9ca4d9cccd6b8fe43
Instruction ID: bd16b24f7d2a15767a95d1b3737d65f52f47dbcf7dff8c8a6f23cca6258988f9
Opcode Fuzzy Hash: 9b919f4984b625d952ac1402723aa15eef98a3d63cb4fef9ca4d9cccd6b8fe43
Instruction Fuzzy Hash: A371B256E19AC591EA11DB2CD5063FDA360F7A9B4CF94E321DB8C12592EF28E2D9C700

Function 00007FF73A54CF5C Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54CF9E

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8159f412307fb601b3c0f37e3e25ac8d9204e86e627c1fc6d64a23aad4728422
Instruction ID: 1ba6637e8370f7b8d45df4544d6c5ba3ac05330b47ebf6c0f67c015a994a5c99
Opcode Fuzzy Hash: 8159f412307fb601b3c0f37e3e25ac8d9204e86e627c1fc6d64a23aad4728422
Instruction Fuzzy Hash: 8A417C66B0C26166FB54BD265506239F790AF46FE4FA44274ED2D477C5DE3CF802A320

Function 00007FF73A556860 Relevance: 1.6, APIs: 1, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A556888

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c5dd71678ec1c3fccfd7b12bb33d50ac5b5a91bc82f8ec354b455621dbb7ad32
Instruction ID: f0b175b48e26d9f6f93145d313ab8937552f70c17b931eb538dad30f7e186191
Opcode Fuzzy Hash: c5dd71678ec1c3fccfd7b12bb33d50ac5b5a91bc82f8ec354b455621dbb7ad32
Instruction Fuzzy Hash: CF4109B6A09241A3FE14AB15D242278B3B0FB52750F840171E78F47B91CF2DE412D360

Function 00007FF73A55309C Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A5530BE

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 18b213fde59874ac87f85e5de4d39c2b719f2023920e8f19be70c6083ce6ebcb
Instruction ID: f7d305492e39acf0e89f09627890492a41cf109d57f51ce8431844da47d3fac1
Opcode Fuzzy Hash: 18b213fde59874ac87f85e5de4d39c2b719f2023920e8f19be70c6083ce6ebcb
Instruction Fuzzy Hash: 1C31C3BAE08A46A1FE10AB35C526378A7909B62FF4F844171E90F077D5DF3CE845A360

Function 00007FF73A546CF0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF73A546D9A

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 04543c25dc23bbea6eed4c1580196473fcdbb1e27e7b47db3dd58aa7784f68c4
Instruction ID: 95f9b10cc90a4db90c558cdf9f13ef6a7f92c8cfac2b7b841e422fda88da10dd
Opcode Fuzzy Hash: 04543c25dc23bbea6eed4c1580196473fcdbb1e27e7b47db3dd58aa7784f68c4
Instruction Fuzzy Hash: 3721B429B0967262FA14AB2295063BAE791BF46BC4FD84071EE0D07B86DE3CE4069310

Function 00007FF73A5562EC Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A5563E3

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fc9ed733c9531663f2a1fa64f5afa218c335b2449458d7cf86e62dd5dbc485b9
Instruction ID: 65f06460e9ea05f2db98e4758b88dff70bc5962e3b2a3b68531c1f6f9fe30e07
Opcode Fuzzy Hash: fc9ed733c9531663f2a1fa64f5afa218c335b2449458d7cf86e62dd5dbc485b9
Instruction Fuzzy Hash: F531B26AA0D292A5FB017F55D44337CA650AB42BA0FD601B5E91E437D3CFBCE444A330

Function 00007FF73A5569CC Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1c2126216073ca25d245121089a136ff3a7aa371bcd7b64ec763e68947bfc6
Instruction ID: 23e4257d676cfd99be07e1942f69e8f852cc92356bbdf5d7cb09891aa70ad0e3
Opcode Fuzzy Hash: 1c1c2126216073ca25d245121089a136ff3a7aa371bcd7b64ec763e68947bfc6
Instruction Fuzzy Hash: 2021F6A6A0D292A5FB017F15D84233CB6506B41BB0F948274FC2E43BD3CE7CE445A320

Function 00007FF73A55765C Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8c837f573c96fa8c8593ba1b7d553f0e89515899b505bf482fc54d7a9b3302
Instruction ID: cf48b098e8db9e4c40caf0d5f3fddaa93700ad9d32acfc12d105b1f3874996db
Opcode Fuzzy Hash: 4f8c837f573c96fa8c8593ba1b7d553f0e89515899b505bf482fc54d7a9b3302
Instruction Fuzzy Hash: A921D1AAE1C252A6FB017F55A84233DB650AF42BA0F9409B4F91E473D3CF7CE4459720

Function 00007FF73A550C88 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A550BED

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6a0c664ea0f4c756350c608c231ff57430cf4264c82a4fdbd8aab7f477704700
Instruction ID: 04cf1720dfdc01fe18dae9bd7b570053c188b003959ad2aa01d80b172ba90328
Opcode Fuzzy Hash: 6a0c664ea0f4c756350c608c231ff57430cf4264c82a4fdbd8aab7f477704700
Instruction Fuzzy Hash: DB1181AAA0C65295FE60BF55940227EE3A0BF87B94F9440B1FA4E47697CF3CD400A720

Function 00007FF73A560954 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A560977

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c350cc26a48ec555f8fe80a66dafdb4ca60a247c62ca8753b8880114feebe66c
Instruction ID: 5ea760af1fb378bc1d5b40f2eca42d8db45fd0ae64f1d42ea6977ae5ef8ec864
Opcode Fuzzy Hash: c350cc26a48ec555f8fe80a66dafdb4ca60a247c62ca8753b8880114feebe66c
Instruction Fuzzy Hash: 3B210777608A4197FB60AF18D042379B3A1FB85B94F949234E65E476E9DF3CD8009B10

Function 00007FF73A5542D8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF73A5542F7

Part of subcall function 00007FF73A5543E0: GetModuleHandleExW.KERNEL32 ref: 00007FF73A5543FC
Part of subcall function 00007FF73A5543E0: GetProcAddress.KERNEL32 ref: 00007FF73A554412
Part of subcall function 00007FF73A5543E0: FreeLibrary.KERNEL32 ref: 00007FF73A55442F

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 43a0ca25b5b6844c1e1db732f007f001f54d2ff9bdd56d7814c1d6215129c12c
Instruction ID: 6c8930bbaed1953185ec8f74f219aa9c12db533ee022d70ada7628b4c19d74ef
Opcode Fuzzy Hash: 43a0ca25b5b6844c1e1db732f007f001f54d2ff9bdd56d7814c1d6215129c12c
Instruction Fuzzy Hash: 6F21BE76E157019AFF10AF79E0412EC73B1EB15309FC5443AE60E02AA9DF38C485DBA0

Function 00007FF73A54CC00 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54CC54

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 050f2a8f569f90b9d9de9d5361addb679e72bb7a6764323921c2888df917ddcb
Instruction ID: 0a959f0934207a033f83dba9d71067ba45f7bb827e890b34a3c065ec3012e368
Opcode Fuzzy Hash: 050f2a8f569f90b9d9de9d5361addb679e72bb7a6764323921c2888df917ddcb
Instruction Fuzzy Hash: 0201A565A0876291FA04FB565806079E794BFC7FE0F9886B1DE6C57BD6CE3CD4016320

Function 00007FF73A555A80 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a92c8017b1c3694242cf642bf5e48a42ebde1ff1b4540aa1cd3d890f4142b9
Instruction ID: c6a819b9df13ad9cf4dba54368e34ee5ab9d7d91a4cee8f6b5b5be750d860d39
Opcode Fuzzy Hash: 66a92c8017b1c3694242cf642bf5e48a42ebde1ff1b4540aa1cd3d890f4142b9
Instruction Fuzzy Hash: 591194BA91C646A6FB04BF54D4462BDF760EB81760FD04172E64E466E6CF7CE004D720

Function 00007FF73A54C840 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54C85D

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9622e763c5cd236c757ac8a113060514a321c2ded92b3e6a5714ac5eeaacb77e
Instruction ID: 9d286567a249af7ee118b1fefc97c39a84276e5aafa08c70ac191d59ec499c20
Opcode Fuzzy Hash: 9622e763c5cd236c757ac8a113060514a321c2ded92b3e6a5714ac5eeaacb77e
Instruction Fuzzy Hash: 200171AAE0811271FE547A66A45727D93505F87764FB506B0F92B4A2C2DE2CE401A260

Function 00007FF73A54D108 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54D13D

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3046e24bed232bedf9ab96f5d1dc5647e2b8c2cb7c1726276d598b4946c118ea
Instruction ID: f3726d42e566fe0ee19046f6f09bef4fbe3f4620361a3addcdd4a1be2bc141c3
Opcode Fuzzy Hash: 3046e24bed232bedf9ab96f5d1dc5647e2b8c2cb7c1726276d598b4946c118ea
Instruction Fuzzy Hash: DE017976A00B16A8FB00EFA0D4424EC77B8FB61748B910225DE4C13718EF34D1A5D390

Function 00007FF73A54CCA8 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54CCD5

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d27ab3f074c20aa396e25fcbfc74d5af21bb4413395d19741f8897ba95156ec4
Instruction ID: 1f2982721f31c249cd13f91852460251bc526391866e038d4112cbb2cee5a92f
Opcode Fuzzy Hash: d27ab3f074c20aa396e25fcbfc74d5af21bb4413395d19741f8897ba95156ec4
Instruction Fuzzy Hash: DAF0F025F0CAA251FA10BA5AA80703DE351AFC7BE0FA80070F92D87B87CE2CD8415720

Function 00007FF73A54C8C4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54C8E6

Part of subcall function 00007FF73A54C840: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54C85D

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 543a764d24b90672a05431dc1a130dac9a0496b5ba23ca517f68794dfbf99782
Instruction ID: 7b680b880d6d1940b2891c52983452cbb80443fe555979f6ea7c493304730a53
Opcode Fuzzy Hash: 543a764d24b90672a05431dc1a130dac9a0496b5ba23ca517f68794dfbf99782
Instruction Fuzzy Hash: 7EF09A68A0C21271FA54BAA9A417179A3909FC3790FB801B0FA1E86283CE2CE441B330

Function 00007FF73A553048 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55306A

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: dccd32863e6f506b4f301f1450c7bfa29d8f33399d9aa950cae963106b31457f
Instruction ID: a488f52968aae4857d2c25da2392a2132dd284ed275de5a023a5958e2272e8a1
Opcode Fuzzy Hash: dccd32863e6f506b4f301f1450c7bfa29d8f33399d9aa950cae963106b31457f
Instruction Fuzzy Hash: A1E0A064A0874260FD04BBA6A422079A2904F82BF0F941770FA3E462D2DE2CD0449320

Function 00007FF73A54FB44 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A559C3C: DeleteCriticalSection.KERNEL32 ref: 00007FF73A559CAE

DeleteCriticalSection.KERNEL32 ref: 00007FF73A54FB75

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: CriticalDeleteSection
String ID:
API String ID: 166494926-0
Opcode ID: fd7f0c77747a2e53e2672ec0a550a66794b54ba8239e7590186985e9b143c46e
Instruction ID: 6871d9a327577a2d50bf1b8805fc69c2ed3409858ae524d716a13535413af75e
Opcode Fuzzy Hash: fd7f0c77747a2e53e2672ec0a550a66794b54ba8239e7590186985e9b143c46e
Instruction Fuzzy Hash: 9FF06C6DF04606A1FF10BB55D49337C93D1DF8A754FC011B1D90E4A6528E1CA084A271

Function 00007FF73A5559CC Relevance: 1.5, APIs: 1, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF73A5559E2

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: acdbf11aae047a79c9ec42cda96ce7ee898aca8c8a575da0409811d9637c2f0e
Instruction ID: a911999d25e898380a1568b52e198857d94d932530f01a15ca9056f698965598
Opcode Fuzzy Hash: acdbf11aae047a79c9ec42cda96ce7ee898aca8c8a575da0409811d9637c2f0e
Instruction Fuzzy Hash: 03D0C789F6D54361FE58BBE2A88713193555F67F41F8450B0E81E411729F1CB4956370

Function 00007FF73A546E20 Relevance: 1.3, APIs: 1, Instructions: 88sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A552BB8: DeleteFileW.KERNELBASE ref: 00007FF73A552BBC
Part of subcall function 00007FF73A552BB8: GetLastError.KERNEL32 ref: 00007FF73A552BC6

Sleep.KERNEL32(0000000100000000,00007FF73A54690E,00000000,00007FF73A5438F7), ref: 00007FF73A546F6A

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: DeleteErrorFileLastSleep
String ID:
API String ID: 3792865491-0
Opcode ID: 22fbbc665f8beedd618d4c615c2cafdb76cce68371e549ef1a4929170aa5c884
Instruction ID: 77d2d7fbbfcc7f92556c2ee7ad5010368f99bad7347759b21297be7894625296
Opcode Fuzzy Hash: 22fbbc665f8beedd618d4c615c2cafdb76cce68371e549ef1a4929170aa5c884
Instruction Fuzzy Hash: 5E41B716D1978192F610AB24D1023FCA370FB9A744FD5A232EBCD12697EF2CA2C8D310

Function 00007FF73A559550 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF73A5586BD,?,?,00000000,00007FF73A54FC79,?,?,?,?,00007FF73A5559F1), ref: 00007FF73A5595A5

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: afbdb11ed1b08d377bc5fadb4004119812ee57a7d3acb3d5a3c71706b847d8e8
Instruction ID: d5b25505d0ca7775d12c404514996402563585c51e4e1458ad5688ce35873623
Opcode Fuzzy Hash: afbdb11ed1b08d377bc5fadb4004119812ee57a7d3acb3d5a3c71706b847d8e8
Instruction Fuzzy Hash: D6F0629CB0A203A1FE54775655032B5D2955F67B80FCC00B0ED0F863D2DF1CE494A230

Function 00007FF73A557D90 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF73A557DCE

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: da64b355eaac81519204d4bb0c2681d204a24ced9ca617c428c4ac08c8bc7bff
Instruction ID: 838cd11c01d95125691ee08ea9dc08ceda928b396c2aba794236050533427393
Opcode Fuzzy Hash: da64b355eaac81519204d4bb0c2681d204a24ced9ca617c428c4ac08c8bc7bff
Instruction Fuzzy Hash: A1F08299B0D60761FF5477A25843275D2805F47BA0FC80AB0FD2F862D2DE2CA4406A30

Non-executed Functions

Function 00007FF73A543C90 Relevance: 285.7, APIs: 54, Strings: 109, Instructions: 443libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF73A542E7E), ref: 00007FF73A543CA0
GetProcAddress.KERNEL32(?,?,00000000,00007FF73A542E7E), ref: 00007FF73A543CDA
GetProcAddress.KERNEL32(?,?,00000000,00007FF73A542E7E), ref: 00007FF73A543CFF
GetProcAddress.KERNEL32(?,?,00000000,00007FF73A542E7E), ref: 00007FF73A543D24
GetProcAddress.KERNEL32(?,?,00000000,00007FF73A542E7E), ref: 00007FF73A543D4C
GetProcAddress.KERNEL32(?,?,00000000,00007FF73A542E7E), ref: 00007FF73A543D74
GetProcAddress.KERNEL32(?,?,00000000,00007FF73A542E7E), ref: 00007FF73A543D9C
GetProcAddress.KERNEL32(?,?,00000000,00007FF73A542E7E), ref: 00007FF73A543DC4
GetProcAddress.KERNEL32(?,?,00000000,00007FF73A542E7E), ref: 00007FF73A543DEC
GetProcAddress.KERNEL32(?,?,00000000,00007FF73A542E7E), ref: 00007FF73A543E14

Strings

Failed to get address for PyErr_Occurred, xrefs: 00007FF73A543FDE
Failed to get address for PyDict_GetItemString, xrefs: 00007FF73A543F8E
Py_IncRef, xrefs: 00007FF73A543E82
Failed to get address for Py_DecRef, xrefs: 00007FF73A543E4E
Failed to get address for PyErr_Clear, xrefs: 00007FF73A543FB6
GetProcAddress, xrefs: 00007FF73A543CB9
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF73A5441E6
Failed to get address for PyObject_Str, xrefs: 00007FF73A54425E
Failed to get address for Py_BuildValue, xrefs: 00007FF73A543E26
Failed to get address for PyModule_GetDict, xrefs: 00007FF73A544196
PyErr_Clear, xrefs: 00007FF73A543F9A
Failed to get address for PySys_SetPath, xrefs: 00007FF73A54434E
PyEval_EvalCode, xrefs: 00007FF73A54435A
PyImport_ExecCodeModule, xrefs: 00007FF73A5440B2
PySys_SetArgvEx, xrefs: 00007FF73A5442BA
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF73A543DFE
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF73A54439E
PyUnicode_Replace, xrefs: 00007FF73A5444EA
Failed to get address for PyUnicode_FromString, xrefs: 00007FF73A5443C6
PySys_SetPath, xrefs: 00007FF73A544332
PySys_AddWarnOption, xrefs: 00007FF73A544292
Failed to get address for Py_VerboseFlag, xrefs: 00007FF73A543DD6
Py_UnbufferedStdioFlag, xrefs: 00007FF73A543DE2
PyErr_NormalizeException, xrefs: 00007FF73A544062
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF73A54443E
PyObject_GetAttrString, xrefs: 00007FF73A54421A
Py_FileSystemDefaultEncoding, xrefs: 00007FF73A543CD0
PyObject_CallFunction, xrefs: 00007FF73A5441A2
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF73A544286
Failed to get address for PyMem_RawFree, xrefs: 00007FF73A544416
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF73A5444B6
Failed to get address for PyList_Append, xrefs: 00007FF73A54411E
Failed to get address for PySys_SetObject, xrefs: 00007FF73A544326
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF73A543CB2
PyUnicode_DecodeFSDefault, xrefs: 00007FF73A544472
Failed to get address for PyImport_AddModule, xrefs: 00007FF73A5440A6
Py_DecodeLocale, xrefs: 00007FF73A5443D2
Py_NoSiteFlag, xrefs: 00007FF73A543D42
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF73A54448E
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF73A5442D6
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF73A543D5E
Failed to get address for PyUnicode_Replace, xrefs: 00007FF73A544506
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF73A5442AE
PyErr_Print, xrefs: 00007FF73A543FEA
Failed to get address for Py_SetPythonHome, xrefs: 00007FF73A543F66
Py_SetPath, xrefs: 00007FF73A543ED2
PySys_GetObject, xrefs: 00007FF73A5442E2
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF73A543D86
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF73A5440CE
Py_BuildValue, xrefs: 00007FF73A543E0A
PyErr_Restore, xrefs: 00007FF73A54403A
Py_OptimizeFlag, xrefs: 00007FF73A543D92
PyErr_Occurred, xrefs: 00007FF73A543FC2
Py_IgnoreEnvironmentFlag, xrefs: 00007FF73A543D1A
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF73A544236
PyImport_ImportModule, xrefs: 00007FF73A5440DA
PyImport_AddModule, xrefs: 00007FF73A54408A
PyList_Append, xrefs: 00007FF73A544102
Failed to get address for PyObject_CallFunction, xrefs: 00007FF73A5441BE
Failed to get address for Py_GetPath, xrefs: 00007FF73A543F16
PyModule_GetDict, xrefs: 00007FF73A54417A
Failed to get address for PyUnicode_Decode, xrefs: 00007FF73A544466
PyRun_SimpleStringFlags, xrefs: 00007FF73A54426A
PyUnicode_Join, xrefs: 00007FF73A5444C2
Py_VerboseFlag, xrefs: 00007FF73A543DBA
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF73A54420E
PyObject_Str, xrefs: 00007FF73A544242
Py_NoUserSiteDirectory, xrefs: 00007FF73A543D6A
PyList_New, xrefs: 00007FF73A54412A
Py_SetPythonHome, xrefs: 00007FF73A543F4A
Failed to get address for PyLong_AsLong, xrefs: 00007FF73A54416E
PyUnicode_FromFormat, xrefs: 00007FF73A544422
PyObject_CallFunctionObjArgs, xrefs: 00007FF73A5441CA
Failed to get address for PyList_New, xrefs: 00007FF73A544146
Failed to get address for Py_IncRef, xrefs: 00007FF73A543E9E
Failed to get address for Py_Finalize, xrefs: 00007FF73A543E76
Py_FrozenFlag, xrefs: 00007FF73A543CF5
Failed to get address for PyEval_EvalCode, xrefs: 00007FF73A544376
PyErr_Fetch, xrefs: 00007FF73A544012
PyDict_GetItemString, xrefs: 00007FF73A543F72
Failed to get address for PyUnicode_Join, xrefs: 00007FF73A5444DE
PyLong_AsLong, xrefs: 00007FF73A544152
Failed to get address for PyErr_Print, xrefs: 00007FF73A544006
Failed to get address for PyErr_Restore, xrefs: 00007FF73A544056
Failed to get address for Py_Initialize, xrefs: 00007FF73A543EC6
PyMarshal_ReadObjectFromString, xrefs: 00007FF73A544382
Py_DontWriteBytecodeFlag, xrefs: 00007FF73A543C96
PyMem_RawFree, xrefs: 00007FF73A5443FA
Failed to get address for Py_DecodeLocale, xrefs: 00007FF73A5443EE
PySys_SetObject, xrefs: 00007FF73A54430A
Py_DecRef, xrefs: 00007FF73A543E32
Py_Initialize, xrefs: 00007FF73A543EAA
Py_Finalize, xrefs: 00007FF73A543E5A
PyUnicode_FromString, xrefs: 00007FF73A5443AA
PyObject_SetAttrString, xrefs: 00007FF73A5441F2
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF73A543DAE
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF73A54407E
Py_SetProgramName, xrefs: 00007FF73A543F22
Py_GetPath, xrefs: 00007FF73A543EFA
Failed to get address for Py_SetPath, xrefs: 00007FF73A543EEE
Failed to get address for Py_SetProgramName, xrefs: 00007FF73A543F3E
PyUnicode_Decode, xrefs: 00007FF73A54444A
Failed to get address for PySys_GetObject, xrefs: 00007FF73A5442FE
Failed to get address for PyImport_ImportModule, xrefs: 00007FF73A5440F6
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF73A543D36
Failed to get address for Py_FrozenFlag, xrefs: 00007FF73A543D11
Failed to get address for PyErr_Fetch, xrefs: 00007FF73A54402E
PyUnicode_AsUTF8, xrefs: 00007FF73A54449A
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF73A543CEC

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-139387903
Opcode ID: 25571350705606e69c6884172ef84a6fbccfbccdf8a43baf74e4d03ce1e63489
Instruction ID: 6315a6105d86b32334033fa35970cead69a2c71da7a3d80e4481140fa301f14f
Opcode Fuzzy Hash: 25571350705606e69c6884172ef84a6fbccfbccdf8a43baf74e4d03ce1e63489
Instruction Fuzzy Hash: C032C46CA4EB13B0FA19FB04B856174A3A1AF1B750BD460B5C80E067B5EF7DE548F260

Function 00007FF73A541B80 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF73A541BCE
MulDiv.KERNEL32 ref: 00007FF73A541BE2
MulDiv.KERNEL32 ref: 00007FF73A541C03
SystemParametersInfoW.USER32 ref: 00007FF73A541C4B
CreateFontIndirectW.GDI32 ref: 00007FF73A541C5F
#380.COMCTL32 ref: 00007FF73A541C83
CreateWindowExW.USER32 ref: 00007FF73A541CD6
CreateWindowExW.USER32 ref: 00007FF73A541D30
CreateWindowExW.USER32 ref: 00007FF73A541D8D
CreateWindowExW.USER32 ref: 00007FF73A541DEF
SendMessageW.USER32 ref: 00007FF73A541E0F
SendMessageW.USER32 ref: 00007FF73A541E29
SendMessageW.USER32 ref: 00007FF73A541E48
SendMessageW.USER32 ref: 00007FF73A541E67
SendMessageW.USER32 ref: 00007FF73A541E85
SendMessageW.USER32 ref: 00007FF73A541EA3
SendMessageW.USER32 ref: 00007FF73A541EC1
SendMessageW.USER32 ref: 00007FF73A541ED9
SendMessageW.USER32 ref: 00007FF73A541EF1
GetClientRect.USER32 ref: 00007FF73A541F00

Part of subcall function 00007FF73A542020: GetDC.USER32 ref: 00007FF73A54204B
Part of subcall function 00007FF73A542020: SelectObject.GDI32 ref: 00007FF73A542096
Part of subcall function 00007FF73A542020: DrawTextW.USER32 ref: 00007FF73A5420B9
Part of subcall function 00007FF73A542020: SelectObject.GDI32 ref: 00007FF73A5420CF
Part of subcall function 00007FF73A542020: ReleaseDC.USER32 ref: 00007FF73A5420DF
Part of subcall function 00007FF73A542020: MoveWindow.USER32 ref: 00007FF73A54212F
Part of subcall function 00007FF73A542020: MoveWindow.USER32 ref: 00007FF73A54216F
Part of subcall function 00007FF73A542020: MoveWindow.USER32 ref: 00007FF73A5421C2

Strings

BUTTON, xrefs: 00007FF73A541DA6
Close, xrefs: 00007FF73A541D98
EDIT, xrefs: 00007FF73A541D3B
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF73A541BAD
STATIC, xrefs: 00007FF73A541C8C, 00007FF73A541CE1

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 405cae881102fd9b4288b25694fdcb7e510b233441f66b6cc7a0f1c85a4d260d
Instruction ID: d5269ba1f7c33a40c1017869300e098ad03e299b0d7bab99b2a5005f597a8529
Opcode Fuzzy Hash: 405cae881102fd9b4288b25694fdcb7e510b233441f66b6cc7a0f1c85a4d260d
Instruction Fuzzy Hash: FFA17A3A218B8197E7149F21E45579EB770F789B90FA05129EB8D03B24CF7DE1A4CB50

Function 00007FF73A55E4EC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1209COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF73A55E531
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55EB31
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55ECE8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55EEFC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55F1A5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55F3A2
memcpy_s.LIBCPMT ref: 00007FF73A55F48D
memcpy_s.LIBCPMT ref: 00007FF73A55F538
memcpy_s.LIBCPMT ref: 00007FF73A55F5FE

Strings

1#IND, xrefs: 00007FF73A55F6A4
1#INF, xrefs: 00007FF73A55F6CF
1#SNAN, xrefs: 00007FF73A55F6B0
1#QNAN, xrefs: 00007FF73A55F6BC

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 22e86934e9aa7124c19ddb337e70a2f8114e375dd55049989a6c0d29b15b255f
Instruction ID: 726e2cfd638ca81f5c66a1da5807106619c96239256bc47c168e51080fba51bb
Opcode Fuzzy Hash: 22e86934e9aa7124c19ddb337e70a2f8114e375dd55049989a6c0d29b15b255f
Instruction Fuzzy Hash: B3B225B6A182829BFB249F24D4427FDB7A1FB45348F901175EA0F97A84DB38E904DB50

Function 00007FF73A546FA0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF73A542690), ref: 00007FF73A546FC7
FormatMessageW.KERNEL32(00000000,00007FF73A542690), ref: 00007FF73A546FF6
WideCharToMultiByte.KERNEL32 ref: 00007FF73A54704C

Part of subcall function 00007FF73A542610: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF73A547233,?,?,?,?,?,?,?,?,?,?,?,00007FF73A54101D), ref: 00007FF73A542644
Part of subcall function 00007FF73A542610: MessageBoxW.USER32 ref: 00007FF73A54271C

Strings

WideCharToMultiByte, xrefs: 00007FF73A54705D
FormatMessageW, xrefs: 00007FF73A547007
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF73A547069
No error messages generated., xrefs: 00007FF73A547000
Failed to encode wchar_t as UTF-8., xrefs: 00007FF73A547056
PyInstaller: FormatMessageW failed., xrefs: 00007FF73A547013

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 3a12c33edb148940672c099e74b863588d93d4457ec079783bd0d804bbb9806a
Instruction ID: f9b717039b47400a2f7e00a4b52e2d3032c7f0f4892379f3c8792fb4fe083bc6
Opcode Fuzzy Hash: 3a12c33edb148940672c099e74b863588d93d4457ec079783bd0d804bbb9806a
Instruction Fuzzy Hash: 7621C539A18A42A2FB60BF11E84627AA360FF4B384FD410B5D64D426B4EF3CD145E720

Function 00007FF73A5482D8 Relevance: 12.0, Strings: 9, Instructions: 730COMMON

Download Yara Rule

Strings

invalid code lengths set, xrefs: 00007FF73A548447
invalid distance too far back, xrefs: 00007FF73A548C3C
invalid literal/length code, xrefs: 00007FF73A5489D8
invalid literal/lengths set, xrefs: 00007FF73A548740
too many length or distance symbols, xrefs: 00007FF73A548460
invalid distances set, xrefs: 00007FF73A5487AD
invalid bit length repeat, xrefs: 00007FF73A5486D2
invalid distance code, xrefs: 00007FF73A548B8A
invalid code -- missing end-of-block, xrefs: 00007FF73A5486B9

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 049921a658be687a5ad71860aa43a6d749bd02c33d2519cf778dba4da53bf44e
Instruction ID: 43830f31ff7879711bae0e57275c7f558fab9e6dff905d03145ed0542193ba16
Opcode Fuzzy Hash: 049921a658be687a5ad71860aa43a6d749bd02c33d2519cf778dba4da53bf44e
Instruction Fuzzy Hash: 89527776A186B69BE794AF14D449A7E77ADFB86300FA14139EA49837C0DF3CD804DB10

Function 00007FF73A54AEE0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF73A54AEFC
RtlCaptureContext.KERNEL32 ref: 00007FF73A54AF29
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF73A54AF43
RtlVirtualUnwind.KERNEL32 ref: 00007FF73A54AF84
IsDebuggerPresent.KERNEL32 ref: 00007FF73A54AFD8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF73A54AFF9
UnhandledExceptionFilter.KERNEL32 ref: 00007FF73A54B004

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e440e0af2a8a59d969f9bdb60f36ca4ebaa98fd206effc6c2ec9c6feadcd0944
Instruction ID: 11a8b60bdbd205aeda8b63fa8f535b8e7c18f23b1fc2905272f9611a36e3021d
Opcode Fuzzy Hash: e440e0af2a8a59d969f9bdb60f36ca4ebaa98fd206effc6c2ec9c6feadcd0944
Instruction Fuzzy Hash: A5315D76609B81AAFB60AF60E8413EDB360FB85744F94403ADA8E47B95DF38D548D720

Function 00007FF73A55C06C Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55C0B5

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 37001c61dc4f3eed81f14e1e40c76d842fb23aae6b6f71e9e67832284e23fd88
Instruction ID: dd8bd7a1daae9e90447e3f7b6f87bb39da955eca6fa0b6aef9750332d17a745f
Opcode Fuzzy Hash: 37001c61dc4f3eed81f14e1e40c76d842fb23aae6b6f71e9e67832284e23fd88
Instruction Fuzzy Hash: 18A1E6AAB1868591FE10EF66A8061BAE3A0FB46BD4F845171FE5F07B84DF3CD4499310

Function 00007FF73A555750 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF73A5557C9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF73A5557E1
RtlVirtualUnwind.KERNEL32 ref: 00007FF73A55581C
IsDebuggerPresent.KERNEL32 ref: 00007FF73A555855
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF73A55585F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF73A55586A

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 7af9a718ba771edf7e69dad524d47659ead305be643fa1df24af60c020ca3b2e
Instruction ID: d9dc34793d21390e4892d6b23bb7758eec992469adfdef0119b0321f9566d5f4
Opcode Fuzzy Hash: 7af9a718ba771edf7e69dad524d47659ead305be643fa1df24af60c020ca3b2e
Instruction Fuzzy Hash: 9E31B436608B81A6EB60DF25E8412AEB3A0FB89754F900135EA9E43B65DF3CC145DB10

Function 00007FF73A556DE0 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF73A556E4F
WriteFile.KERNEL32 ref: 00007FF73A557106
WriteFile.KERNEL32 ref: 00007FF73A557158
GetLastError.KERNEL32 ref: 00007FF73A55725A
GetLastError.KERNEL32 ref: 00007FF73A5572BA

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 0a19410c419814db5db070c5d12a1b78bfb040d79319ef459e0b6fcfc05cf743
Instruction ID: f34fcc560e5ed2adb6fe13546538d5f559d9b9ad4be796dc631ca30c6bc24154
Opcode Fuzzy Hash: 0a19410c419814db5db070c5d12a1b78bfb040d79319ef459e0b6fcfc05cf743
Instruction Fuzzy Hash: 63E122B6B08A81AAFB00DF64D0411ADBBB1FB46788F904576FE4E17B98DE38D416C710

Function 00007FF73A55FF2C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A55BF74: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55BFA2

_get_daylight.LIBCMT ref: 00007FF73A560049
_get_daylight.LIBCMT ref: 00007FF73A56005A

Strings

?, xrefs: 00007FF73A55FFD5

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 04833c3b7dc3858268eb9e0a584bbc25512f1991472f0a42b83565db3ec32565
Instruction ID: c7899313b8df1c1c56781e5839cb3841c47a70e72593d75b0fc75fec33342440
Opcode Fuzzy Hash: 04833c3b7dc3858268eb9e0a584bbc25512f1991472f0a42b83565db3ec32565
Instruction Fuzzy Hash: 2A91076BE0825266FB20BB26D40227AA761EF827E4F908171FE4E47AD5DF3CD441E750

Function 00007FF73A547AA4 Relevance: 5.4, Strings: 4, Instructions: 399COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF73A547AF9
header crc mismatch, xrefs: 00007FF73A547F3E
, xrefs: 00007FF73A547B89
unknown compression method, xrefs: 00007FF73A547AD8

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-4074041902
Opcode ID: 3ccf8dfa57ebed5ae874e87ea7e697ea666599418b435e4c2251ebe5a9e21131
Instruction ID: d585a1a225b4c13e6cf677410feee09103bfdb07f05fbec580105cad59629c2f
Opcode Fuzzy Hash: 3ccf8dfa57ebed5ae874e87ea7e697ea666599418b435e4c2251ebe5a9e21131
Instruction Fuzzy Hash: 20F12576A083E9A7F7A5AF14C089A3ABBA9FF47740F6145B8DA4D03390DB38D840D750

Function 00007FF73A55E0C0 Relevance: 4.8, APIs: 3, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF73A55E126
memcpy_s.LIBCPMT ref: 00007FF73A55E151

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 61c8d48a73c74d7b2b5693099c23eccbf95a4682f3061de545b2f75f73c9d44c
Instruction ID: 8b92c9491776b33a29000dbb01d7b2df74d3f66bf172674ed70a62465e40f8d8
Opcode Fuzzy Hash: 61c8d48a73c74d7b2b5693099c23eccbf95a4682f3061de545b2f75f73c9d44c
Instruction Fuzzy Hash: 19C111B6B582869BEB24DF19E149A6AB791F785784F848134EF4F43784DA3CE800DB44

Function 00007FF73A54A060 Relevance: 4.1, Strings: 3, Instructions: 384COMMON

Download Yara Rule

Strings

invalid distance too far back, xrefs: 00007FF73A54A4D0
invalid literal/length code, xrefs: 00007FF73A54A496
invalid distance code, xrefs: 00007FF73A54A4B3

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID: invalid distance code$invalid distance too far back$invalid literal/length code
API String ID: 0-3255898291
Opcode ID: 5ccc26b74eac166d3016146671465d669a63232148addc042f7b457501de7681
Instruction ID: 6a3c027b53543b8dca68a8fff89274db3c3370d58e0f7aaaaea5b5878ddf2a67
Opcode Fuzzy Hash: 5ccc26b74eac166d3016146671465d669a63232148addc042f7b457501de7681
Instruction Fuzzy Hash: E5D18836A0C5E18BE7999F38D40627CBBE1E796340F54827AEB8A437C1DA3CD909D710

Function 00007FF73A54790D Relevance: 4.0, Strings: 3, Instructions: 219COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF73A547A72
incorrect header check, xrefs: 00007FF73A547A8B
unknown compression method, xrefs: 00007FF73A5479F7

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size$unknown compression method
API String ID: 0-1186847913
Opcode ID: 933fdda2a0a693fb4704c872a706b9889a7611392e337090ac754fb873cc17c4
Instruction ID: 18d881bdb3d91c98b13d06b00705d04bcd42670dc532a0aeef0ec7a201ec1f93
Opcode Fuzzy Hash: 933fdda2a0a693fb4704c872a706b9889a7611392e337090ac754fb873cc17c4
Instruction Fuzzy Hash: CA913B76A18396ABF7A4AF14D489B3E77ADFF42340F6141B9DA4943780CB38E940DB10

Function 00007FF73A547FCC Relevance: 3.9, Strings: 3, Instructions: 161COMMON

Download Yara Rule

Strings

, xrefs: 00007FF73A547FCC
invalid block type, xrefs: 00007FF73A5480CF
, xrefs: 00007FF73A547FEA

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID: $ $invalid block type
API String ID: 0-2056396358
Opcode ID: 6941b897d4e00403c18809f6a673ff2f5a89638ff58ad76ef09c7e80b304dd39
Instruction ID: 62311c5d62794726c871cb55c1ab8c614d6ad10236cd074f74647014c94f3738
Opcode Fuzzy Hash: 6941b897d4e00403c18809f6a673ff2f5a89638ff58ad76ef09c7e80b304dd39
Instruction Fuzzy Hash: 5A61F8B790439AABF760AF15D88D63EBBACFB02350FA141B5D64882390DF39D544DB50

Function 00007FF73A5587F4 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A558858

Strings

gfffffff, xrefs: 00007FF73A558B09

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 6e6b374e358ffb98ed3835fe1ad345463b8c13656902312dc80815bb4bc071b0
Instruction ID: 8c7934bdd483e1470a5e26e3230514757056ba4802fce40652b217bde613ad09
Opcode Fuzzy Hash: 6e6b374e358ffb98ed3835fe1ad345463b8c13656902312dc80815bb4bc071b0
Instruction Fuzzy Hash: 569145A6B083CA96FF11DB25D0013B9AB94AB52BD4F458072EE4E57781DE3CE502A311

Function 00007FF73A559200 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A559236

Part of subcall function 00007FF73A555984: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF73A555961), ref: 00007FF73A55598D
Part of subcall function 00007FF73A555984: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF73A555961), ref: 00007FF73A5559B2

Strings

-, xrefs: 00007FF73A559428

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: -
API String ID: 4036615347-2547889144
Opcode ID: 9a225e88cd471c9f0d28c8492e0b3f4a847acdc232b1f098b5a0036e8607a1c4
Instruction ID: 55a7d17b180bbaba47cdc1210db7f9a402835827052de871b7fd137b07915c27
Opcode Fuzzy Hash: 9a225e88cd471c9f0d28c8492e0b3f4a847acdc232b1f098b5a0036e8607a1c4
Instruction Fuzzy Hash: A89103B6A08385D6FE60DB16D50176AF791FB96B90F844275FA9E43BD8DB3CE4009700

Function 00007FF73A563C18 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF73A563E67
RaiseException.KERNEL32 ref: 00007FF73A563E78

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: cc44eefe37f4df5582d82a49112138722456b84e82797c40e34ba7e475433f75
Instruction ID: 67ce9825739395fd65a5afceeb7f978ee3688b696cfff71c427b40010b133ad6
Opcode Fuzzy Hash: cc44eefe37f4df5582d82a49112138722456b84e82797c40e34ba7e475433f75
Instruction Fuzzy Hash: B0B18C7BA00B848BEB15CF29C886368BBB0F785B98F548861DB5D877B4CB39D851D710

Function 00007FF73A55B13C Relevance: 1.9, APIs: 1, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e2423343613580658420df5e06338113168b5850563fb793d6fdeaad8ddf55
Instruction ID: 5c4abe4bb22bdb965d35619a457ad7f131dd1e319106994d531941a5ee36566b
Opcode Fuzzy Hash: 71e2423343613580658420df5e06338113168b5850563fb793d6fdeaad8ddf55
Instruction Fuzzy Hash: 6E02B5A9B1E70660FE14BB119407279B694AF03BA0F9646B5FD6E467D1FE3CA401A320

Function 00007FF73A560A18 Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF73A560A7C

Part of subcall function 00007FF73A550EB0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A550EC4

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: c11f467a6d657cef50c7cbfb409fd7db21a501e8047c77c3d86f54ab6e5c7b64
Instruction ID: 053d986bfc1cb5928a6812094c59a51ac89086c2a3993ebf9de0b6577c0137de
Opcode Fuzzy Hash: c11f467a6d657cef50c7cbfb409fd7db21a501e8047c77c3d86f54ab6e5c7b64
Instruction Fuzzy Hash: 74715A2BE0C282A6FB246E29944223DE381EF42360F94D6B5D61D476F5DF3DE840A320

Function 00007FF73A54E80C Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF73A54E9DB

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a375ce7d8ac190a774d9db1b0bbd49aa5845f631dc9fe3244db92a46c16961f0
Instruction ID: dafb26f99348d4e8995fefb77e597095c935cf38c842957964e3e2224d774307
Opcode Fuzzy Hash: a375ce7d8ac190a774d9db1b0bbd49aa5845f631dc9fe3244db92a46c16961f0
Instruction Fuzzy Hash: B371386DA5C22362FBA4BA1A40062F9A391EF42744FE450B2DD4D432D9CF3CE843B725

Function 00007FF73A552BE0 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF73A552BFF

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: a07ee93b30fd6f1bc983e7ec6da7ee48b87d60621c2c441c0d2d6bf3525f0f80
Instruction ID: a29ee82c44c76138ddf95b7fad3943d1e3fbe66ab271a5a7b701dfa94f53402a
Opcode Fuzzy Hash: a07ee93b30fd6f1bc983e7ec6da7ee48b87d60621c2c441c0d2d6bf3525f0f80
Instruction Fuzzy Hash: 9E61C299B0834261FE6CBB22550217EE291AF47BC4FC84075ED0F47796EE3CE442A720

Function 00007FF73A54E5A4 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF73A54E73D

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: b79696a407a2e1f99417375bab57c27b4c70aed7112a41bb3197fc5d58abf242
Instruction ID: ba23ecc86924efeafae9daf1117e83908735e9505101d0bede35da9bc63d4aa4
Opcode Fuzzy Hash: b79696a407a2e1f99417375bab57c27b4c70aed7112a41bb3197fc5d58abf242
Instruction Fuzzy Hash: 14613B2DE8C1A266FA686A2960033FAD7919F43744FF411B1DD88472C9CE2DE847B721

Function 00007FF73A55DB48 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF73A55DB4C

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8801fbc29237cde97098c2992bb5712ac8fa4bdca70bfcd9b7dcc25e25bd9bb3
Instruction ID: 02a7493ef890eb3fea1a1f398f367efaa7ab3698033651398e8c2007f1ac2eaf
Opcode Fuzzy Hash: 8801fbc29237cde97098c2992bb5712ac8fa4bdca70bfcd9b7dcc25e25bd9bb3
Instruction Fuzzy Hash: 34B09228F1BA02E2FA083B51AC8321463A9BF8A710FC800B8D44E40330DF3C20E9A720

Function 00007FF73A549760 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1385a6dc4bf741762803ad4c6cf90cf37c55bf401a043c8da06b4fed85b1e8de
Instruction ID: e3e73a899c5d5053767ee58c857431b146600e02bb7d37a4dc5c9862b23284e6
Opcode Fuzzy Hash: 1385a6dc4bf741762803ad4c6cf90cf37c55bf401a043c8da06b4fed85b1e8de
Instruction Fuzzy Hash: 9971CEB27341749BEB648B2E9515AA93390F36A349FC16115EB8447B81CF3EB921CB50

Function 00007FF73A550700 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ef73793ea1788ae08d57b95515db7d43b127d7364744ae73512ded182e4f5a
Instruction ID: d3169bf1e58e3230c505c78ff5d9651221e74dc06f7cd1acea824ae5cbd4735f
Opcode Fuzzy Hash: d6ef73793ea1788ae08d57b95515db7d43b127d7364744ae73512ded182e4f5a
Instruction Fuzzy Hash: 8041B3DB81D64A2CFD99A9180501BB4A780AF13BA2DD857F0FD9B137C7C90C3586A520

Function 00007FF73A554684 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 8958e6767b35e025a777fc64e267e5a93d0e49a495af46bf7bc8d34417ddc14c
Instruction ID: ba785b0899750ebfae2a7d48d6b18a76d00825242250ec9a8aa27a41ef541a26
Opcode Fuzzy Hash: 8958e6767b35e025a777fc64e267e5a93d0e49a495af46bf7bc8d34417ddc14c
Instruction Fuzzy Hash: 66411476714A5492FF04DF2AD916169B7A1F74AFE4B899032EE0E97B58DF3CC1429300

Function 00007FF73A563A60 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd83198f846778d29d018d0185ecddc9eeca64a8fdced8fb6dbde6c39c1dffb
Instruction ID: 17c6390cf9e3953bdd6933e7d4c39fbd6ae3245be3324489d034eb287050e137
Opcode Fuzzy Hash: 4bd83198f846778d29d018d0185ecddc9eeca64a8fdced8fb6dbde6c39c1dffb
Instruction Fuzzy Hash: 7AF06875B182659AEB949F29BC0362977D4F7093C0FC08079D99D83B14DA3C9051AF14

Function 00007FF73A54B0C4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3e1ff0ce676b4cbccc0a96f9ce58280626e59de3549e9ee2853c98f0f76dbb
Instruction ID: 2f183b5ebfcf6dcd675c146c521732bcb5ded5ff72f90d12faff0f091bc73823
Opcode Fuzzy Hash: 5d3e1ff0ce676b4cbccc0a96f9ce58280626e59de3549e9ee2853c98f0f76dbb
Instruction Fuzzy Hash: 98A0027D94CD12F0F704AF04E952038B734FB52301BD250B1C15E410B49F3EA500E320

Function 00007FF73A5451F0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A546CA0: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF73A542E7E), ref: 00007FF73A546CC3

GetProcAddress.KERNEL32 ref: 00007FF73A545AD7
GetProcAddress.KERNEL32 ref: 00007FF73A545B16
GetProcAddress.KERNEL32 ref: 00007FF73A545B3B
GetProcAddress.KERNEL32 ref: 00007FF73A545B60
GetProcAddress.KERNEL32 ref: 00007FF73A545B88
GetProcAddress.KERNEL32 ref: 00007FF73A545BB0
GetProcAddress.KERNEL32 ref: 00007FF73A545BD8
GetProcAddress.KERNEL32 ref: 00007FF73A545C00
GetProcAddress.KERNEL32 ref: 00007FF73A545C28

Strings

Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF73A545E42
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF73A545BEA
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF73A545CB2
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF73A545E6A
Tcl_GetObjResult, xrefs: 00007FF73A545E76
Tcl_EvalEx, xrefs: 00007FF73A545EC6
Tcl_NewStringObj, xrefs: 00007FF73A545DFE
Failed to get address for Tcl_GetVar2, xrefs: 00007FF73A545D7A
Tk_GetNumMainWindows, xrefs: 00007FF73A545F8E
GetProcAddress, xrefs: 00007FF73A545AF0
Failed to get address for Tcl_GetString, xrefs: 00007FF73A545DF2
Tcl_Init, xrefs: 00007FF73A545AD0
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF73A545E1A
Tcl_EvalFile, xrefs: 00007FF73A545E9E
Failed to get address for Tcl_Alloc, xrefs: 00007FF73A545F32
Tcl_MutexUnlock, xrefs: 00007FF73A545C6E
Tcl_DoOneEvent, xrefs: 00007FF73A545B56
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF73A54523A
Tcl_ThreadQueueEvent, xrefs: 00007FF73A545D0E
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF73A545B28
Tk_Init, xrefs: 00007FF73A545F66
Tcl_ConditionNotify, xrefs: 00007FF73A545CBE
Failed to get address for Tcl_EvalFile, xrefs: 00007FF73A545EBA
Tcl_DeleteInterp, xrefs: 00007FF73A545BCE
Tcl_ConditionFinalize, xrefs: 00007FF73A545C96
Tcl_SetVar2, xrefs: 00007FF73A545D86
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF73A545CDA
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF73A545B4D
Tcl_NewByteArrayObj, xrefs: 00007FF73A545E26
Failed to get address for Tcl_SetVar2, xrefs: 00007FF73A545DA2
Tcl_Finalize, xrefs: 00007FF73A545B7E
Tcl_CreateThread, xrefs: 00007FF73A545BF6
Tcl_Free, xrefs: 00007FF73A545F3E
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF73A545E92
Failed to get address for Tcl_MutexLock, xrefs: 00007FF73A545C62
Tcl_FindExecutable, xrefs: 00007FF73A545B31
Tcl_ConditionWait, xrefs: 00007FF73A545CE6
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF73A545C8A
Tcl_GetVar2, xrefs: 00007FF73A545D5E
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF73A545DCA
Tcl_CreateInterp, xrefs: 00007FF73A545B0C
Tcl_SetVar2Ex, xrefs: 00007FF73A545E4E
Tcl_GetCurrentThread, xrefs: 00007FF73A545C1E
Tcl_Alloc, xrefs: 00007FF73A545F16
Failed to get address for Tcl_Finalize, xrefs: 00007FF73A545B9A
Failed to get address for Tcl_Free, xrefs: 00007FF73A545F5A
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF73A545D2A
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF73A545D52
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF73A545FAA
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF73A545D02
Tcl_MutexLock, xrefs: 00007FF73A545C46
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF73A545C3A
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF73A545F0A
Failed to get address for Tcl_Init, xrefs: 00007FF73A545AE9
Tcl_FinalizeThread, xrefs: 00007FF73A545BA6
Failed to get address for Tcl_EvalEx, xrefs: 00007FF73A545EE2
Tcl_ThreadAlert, xrefs: 00007FF73A545D36
Failed to get address for Tk_Init, xrefs: 00007FF73A545F82
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF73A545BC2
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF73A545B72
Tcl_GetString, xrefs: 00007FF73A545DD6
Tcl_EvalObjv, xrefs: 00007FF73A545EEE
Tcl_CreateObjCommand, xrefs: 00007FF73A545DAE
Failed to get address for Tcl_CreateThread, xrefs: 00007FF73A545C12

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: e95c3f220ff907c97ac3a5505cef918bda10cea1a09b7661ea358f21aa108c0d
Instruction ID: 519432c1426e44450f77ae8c47e157a805988fbc1ff7b861bd8f4daf455cc711
Opcode Fuzzy Hash: e95c3f220ff907c97ac3a5505cef918bda10cea1a09b7661ea358f21aa108c0d
Instruction Fuzzy Hash: 5BE1F46CA1EB03B0FA15FF04A892178A3A5BF17751BD460B5D80E063A4EF7CE944E270

Function 00007FF73A542020 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF73A54204B
SelectObject.GDI32 ref: 00007FF73A542096
DrawTextW.USER32 ref: 00007FF73A5420B9
SelectObject.GDI32 ref: 00007FF73A5420CF
ReleaseDC.USER32 ref: 00007FF73A5420DF
MoveWindow.USER32 ref: 00007FF73A54212F
MoveWindow.USER32 ref: 00007FF73A54216F
MoveWindow.USER32 ref: 00007FF73A5421C2
MoveWindow.USER32 ref: 00007FF73A54220A

Strings

P%, xrefs: 00007FF73A5420A3

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: aae4e62fcfd093211e570d6b90d2c8fdd41e88a62d8dc34d7df732e47f0cc643
Instruction ID: f9f85d7e0333555021088a72fd3bfd41950f6dc34697d8dfa9f0a00321caf27b
Opcode Fuzzy Hash: aae4e62fcfd093211e570d6b90d2c8fdd41e88a62d8dc34d7df732e47f0cc643
Instruction Fuzzy Hash: 625106366187A186E6349F26B0181BAF7A1FB98BA1F404125EFCE43694DF7CD085DB20

Function 00007FF73A5412B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF73A5413E2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF73A541312
Failed to extract %s: failed to open archive file!, xrefs: 00007FF73A5412E2
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF73A54134C
fread, xrefs: 00007FF73A5413E9
malloc, xrefs: 00007FF73A541353
fseek, xrefs: 00007FF73A541319

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 6038bda91e724b27f8f23ebec308025eacab26cfe33c24912f0010ea18be9294
Instruction ID: a852c86d1a59e4bf82c9fccbb13a6ae86df7602f6c63f61c35351b4f6dddf059
Opcode Fuzzy Hash: 6038bda91e724b27f8f23ebec308025eacab26cfe33c24912f0010ea18be9294
Instruction Fuzzy Hash: 0D41B329B48662A2FA14FB16E4022B9E3A0FF427D4FE45472DE4D47B55EE3CE441E320

Function 00007FF73A5470F0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73A54101D), ref: 00007FF73A54718F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73A54101D), ref: 00007FF73A5471DF

Strings

WideCharToMultiByte, xrefs: 00007FF73A547227
Failed to get UTF-8 buffer size., xrefs: 00007FF73A547220
win32_utils_to_utf8, xrefs: 00007FF73A547217
Out of memory., xrefs: 00007FF73A547210
Failed to encode wchar_t as UTF-8., xrefs: 00007FF73A547207

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: db19f9d4aef0fef02a9726d572e44277a2e87ac6caf3807b1813383a65a9fa67
Instruction ID: 3e8e77646f99c98951e37003c2afb4a2cbb5bc85afd3530dda219a9d3cd45725
Opcode Fuzzy Hash: db19f9d4aef0fef02a9726d572e44277a2e87ac6caf3807b1813383a65a9fa67
Instruction Fuzzy Hash: F341E036A0CB9292F620EF15B44217AF7A4FB86790FA45075EA8D43BA4DF3CD055E710

Function 00007FF73A5475A0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF73A54353B), ref: 00007FF73A5475E1

Part of subcall function 00007FF73A542610: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF73A547233,?,?,?,?,?,?,?,?,?,?,?,00007FF73A54101D), ref: 00007FF73A542644
Part of subcall function 00007FF73A542610: MessageBoxW.USER32 ref: 00007FF73A54271C

WideCharToMultiByte.KERNEL32(?,00007FF73A54353B), ref: 00007FF73A547655

Strings

WideCharToMultiByte, xrefs: 00007FF73A5475F5, 00007FF73A547666
Failed to get UTF-8 buffer size., xrefs: 00007FF73A5475EE
win32_utils_to_utf8, xrefs: 00007FF73A547622
Out of memory., xrefs: 00007FF73A54761B
Failed to encode wchar_t as UTF-8., xrefs: 00007FF73A54765F

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 415e80d084b85328e4a76e8d77a212f49e392635e65cd740730017958ab796a4
Instruction ID: 0c87112f665d5d220364e17ec8f096d7b43ea62c1460287412232f21fdfd5d10
Opcode Fuzzy Hash: 415e80d084b85328e4a76e8d77a212f49e392635e65cd740730017958ab796a4
Instruction Fuzzy Hash: 6521E428A18B53A5FB10EF1AE842039B391EB46BC0FA44575CA4D437A5EF3CE441D310

Function 00007FF73A547690 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF73A547725
MultiByteToWideChar.KERNEL32 ref: 00007FF73A547767

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF73A54778C
MultiByteToWideChar, xrefs: 00007FF73A5477AC
Failed to get wchar_t buffer size., xrefs: 00007FF73A5477A5
win32_utils_from_utf8, xrefs: 00007FF73A54779C
Out of memory., xrefs: 00007FF73A547795

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: 17909a0ae730aba59136d9b37091d1e97452f1173110cb104400f616486276bb
Instruction ID: 86bebfbe0b573ef428352c633197c7a153623cfb54c2bc69f2ed103ae6bcee5d
Opcode Fuzzy Hash: 17909a0ae730aba59136d9b37091d1e97452f1173110cb104400f616486276bb
Instruction Fuzzy Hash: BC41F83AA08B62A2F610EF15A84217AF7A5FB46B90FE01175DE9D47BA4DF3CD005D710

Function 00007FF73A545FD0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A547490: MultiByteToWideChar.KERNEL32 ref: 00007FF73A5474CA

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF73A54631F,?,00000000,?,TokenIntegrityLevel), ref: 00007FF73A54602F

Part of subcall function 00007FF73A542760: MessageBoxW.USER32 ref: 00007FF73A542831

Strings

LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF73A546006
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF73A546043
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF73A54608A

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 3f4e6d428adc68c16edccf86ca653a7b6763fad0898be320a07c9e9e81028b3c
Instruction ID: e7fadcd177b6717e78027b78fb7e5354ddf2d6fc25e9d06986dc8bd2db3d8534
Opcode Fuzzy Hash: 3f4e6d428adc68c16edccf86ca653a7b6763fad0898be320a07c9e9e81028b3c
Instruction Fuzzy Hash: 5631D859B1D75260FA64B721D5133FAD391AF9A7C0FD44071DA4E43BD6EE2CE104A720

Function 00007FF73A54C420 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF73A54C6D2,?,?,?,00007FF73A54C3CC,?,?,?,?,00007FF73A54C0ED), ref: 00007FF73A54C4A5
GetLastError.KERNEL32(?,?,?,00007FF73A54C6D2,?,?,?,00007FF73A54C3CC,?,?,?,?,00007FF73A54C0ED), ref: 00007FF73A54C4B3
LoadLibraryExW.KERNEL32(?,?,?,00007FF73A54C6D2,?,?,?,00007FF73A54C3CC,?,?,?,?,00007FF73A54C0ED), ref: 00007FF73A54C4DD
FreeLibrary.KERNEL32(?,?,?,00007FF73A54C6D2,?,?,?,00007FF73A54C3CC,?,?,?,?,00007FF73A54C0ED), ref: 00007FF73A54C523
GetProcAddress.KERNEL32(?,?,?,00007FF73A54C6D2,?,?,?,00007FF73A54C3CC,?,?,?,?,00007FF73A54C0ED), ref: 00007FF73A54C52F

Strings

api-ms-, xrefs: 00007FF73A54C4C5

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 1c453ae4bf38a437f7b70d8e644795e8176eb85b810932e67f5fd4f40fb0e1dd
Instruction ID: f908c7d7d570efbd861cc29d9ade0a8205c4e81a04303612df59805f2be3c827
Opcode Fuzzy Hash: 1c453ae4bf38a437f7b70d8e644795e8176eb85b810932e67f5fd4f40fb0e1dd
Instruction Fuzzy Hash: 8E31E729B1A652A1FE11BB06A4055B9A3D4FF4BBA4FEA0574DD1D0B354EF3CE040E320

Function 00007FF73A547490 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF73A5474CA

Part of subcall function 00007FF73A542610: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF73A547233,?,?,?,?,?,?,?,?,?,?,?,00007FF73A54101D), ref: 00007FF73A542644
Part of subcall function 00007FF73A542610: MessageBoxW.USER32 ref: 00007FF73A54271C

MultiByteToWideChar.KERNEL32 ref: 00007FF73A547550

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF73A54755A
MultiByteToWideChar, xrefs: 00007FF73A5474DE, 00007FF73A547561
Failed to get wchar_t buffer size., xrefs: 00007FF73A5474D7
win32_utils_from_utf8, xrefs: 00007FF73A547519
Out of memory., xrefs: 00007FF73A547512

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: a6f1c9715947d873718802f76a212db1658c74b085baec75c1e349c2d31a076f
Instruction ID: efd75f00e2038741fab5306f2c4c6ce7ac7db52b276168e57eae17655614b51f
Opcode Fuzzy Hash: a6f1c9715947d873718802f76a212db1658c74b085baec75c1e349c2d31a076f
Instruction Fuzzy Hash: 4721D229B08A5292FB10EF1AF44207AE3A1FB867C4F984571DB5C83B69EE2CE4419710

Function 00007FF73A562280 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF73A5622B1
GetLastError.KERNEL32 ref: 00007FF73A5622BD
CloseHandle.KERNEL32 ref: 00007FF73A5622D5
CreateFileW.KERNEL32 ref: 00007FF73A562300
WriteConsoleW.KERNEL32 ref: 00007FF73A56231F

Strings

CONOUT$, xrefs: 00007FF73A5622E1

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: bcad4bfd22897d90546c83000e2a55e68d64a70218818eb37a662133ca5c2491
Instruction ID: 9269dcd56e03488f6b7cf8280ad0321dae4880134d695ea31d0c92097a468a78
Opcode Fuzzy Hash: bcad4bfd22897d90546c83000e2a55e68d64a70218818eb37a662133ca5c2491
Instruction Fuzzy Hash: 02119035B18B4196F350AF12F855329E3A0FB8ABE4F841274EA5D877A4DF3CD5448750

Function 00007FF73A542230 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF73A54241F), ref: 00007FF73A542268
DialogBoxIndirectParamW.USER32 ref: 00007FF73A54232C
DeleteObject.GDI32 ref: 00007FF73A54235F
DestroyIcon.USER32 ref: 00007FF73A542371

Strings

Unhandled exception in script, xrefs: 00007FF73A542298

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1b90a2c0030e49ce2696c97bf52dabf9fe93a82d716dc48c73cf63905148fc22
Instruction ID: a6a274f996216ab0522bcf646a582d56b2e27d0047dc3301c54f72878dba9b8e
Opcode Fuzzy Hash: 1b90a2c0030e49ce2696c97bf52dabf9fe93a82d716dc48c73cf63905148fc22
Instruction Fuzzy Hash: DE318076A08A9295FB20EF21E8521F9B360FF8A784F900175EA4E4BA55DF3CD105D710

Function 00007FF73A542610 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF73A547233,?,?,?,?,?,?,?,?,?,?,?,00007FF73A54101D), ref: 00007FF73A542644

Part of subcall function 00007FF73A546FA0: GetLastError.KERNEL32(00000000,00007FF73A542690), ref: 00007FF73A546FC7
Part of subcall function 00007FF73A546FA0: FormatMessageW.KERNEL32(00000000,00007FF73A542690), ref: 00007FF73A546FF6

Part of subcall function 00007FF73A547490: MultiByteToWideChar.KERNEL32 ref: 00007FF73A5474CA

MessageBoxW.USER32 ref: 00007FF73A54271C
MessageBoxA.USER32 ref: 00007FF73A542738

Strings

%s%s: %s, xrefs: 00007FF73A54269D
Fatal error detected, xrefs: 00007FF73A5426F0, 00007FF73A54272A

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: 400fce4ea561395ecb7c9931c898940bca1409bd045f3b8d566701ceccfa415d
Instruction ID: 9dfd6201f0542fddee9de041590e4e9fcda08789932998a244eda347585939c6
Opcode Fuzzy Hash: 400fce4ea561395ecb7c9931c898940bca1409bd045f3b8d566701ceccfa415d
Instruction Fuzzy Hash: E231A676628692A1FB30BB10F4527EAA364FF85788FC05036E68D03A99DF3CD205DB50

Function 00007FF73A5543E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF73A5543FC
GetProcAddress.KERNEL32 ref: 00007FF73A554412
FreeLibrary.KERNEL32 ref: 00007FF73A55442F

Strings

CorExitProcess, xrefs: 00007FF73A55440B
mscoree.dll, xrefs: 00007FF73A5543F3

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5a160c9bdce1f9d43ea406b437463d4fa60eb1ab7842eb725466103b76bc2848
Instruction ID: 25c9f1d8b5b217a8ca1c2472c9f1754aaa910e6a93e5462012ad480ac8ad4566
Opcode Fuzzy Hash: 5a160c9bdce1f9d43ea406b437463d4fa60eb1ab7842eb725466103b76bc2848
Instruction Fuzzy Hash: 71F05469B5D642A1FF54AF51E4563789361AF45B51FC42075E54F46170CF3CD488D320

Function 00007FF73A563854 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF73A56387C
_set_statfp.LIBCMT ref: 00007FF73A563897
_set_statfp.LIBCMT ref: 00007FF73A5638B3
_set_statfp.LIBCMT ref: 00007FF73A5638EF

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: b937517b4f482d0939308dbd49bace3de9952a95ba32e0c18fc8e236c2565ddb
Instruction ID: 15f3ab38eef5e152480e3a1d29a29b9567fd33e751be67de1bb34981681a4ac7
Opcode Fuzzy Hash: b937517b4f482d0939308dbd49bace3de9952a95ba32e0c18fc8e236c2565ddb
Instruction Fuzzy Hash: F811602EE19A4331F6543324E5533B5D0506F76374F9C26B8EB6E063F68E1CA845A220

Function 00007FF73A55A940 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55AC1F

Part of subcall function 00007FF73A560670: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A56068D

Strings

UTF-8, xrefs: 00007FF73A55AB9E
UTF-16LEUNICODE, xrefs: 00007FF73A55ABBD
ccs, xrefs: 00007FF73A55AB5A

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 55788242df50e1a30cd54507ff4bf163bc38528b1732f9cc2afaa672e73b8d51
Instruction ID: 5819a22d10b357152c14413cd6888aecda7ea1655990cd6ca95bcfd29fd83f32
Opcode Fuzzy Hash: 55788242df50e1a30cd54507ff4bf163bc38528b1732f9cc2afaa672e73b8d51
Instruction Fuzzy Hash: A781E5FAE08242A5FF646E25C20A238B6A1AB13754FD580B1FB0B57295DB2DF441F361

Function 00007FF73A5424C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A547490: MultiByteToWideChar.KERNEL32 ref: 00007FF73A5474CA

MessageBoxW.USER32 ref: 00007FF73A5425C7
MessageBoxA.USER32 ref: 00007FF73A5425E3

Strings

%s%s: %s, xrefs: 00007FF73A542548
Fatal error detected, xrefs: 00007FF73A54259B, 00007FF73A5425D5

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 69d8018c69fa0ba47995e0ce162d6b42525d4d2d5850a1053315e8c6180101b4
Instruction ID: f3a318b5f14ce2d586d72825eca47f6cc0e9ce4e4267d3f7b56a9328ed444df0
Opcode Fuzzy Hash: 69d8018c69fa0ba47995e0ce162d6b42525d4d2d5850a1053315e8c6180101b4
Instruction Fuzzy Hash: F731B776628692A1F620BB10F4527EAA364FB85784FD04035EA8D47A99DF3CD305DB50

Function 00007FF73A543A40 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF73A54353B), ref: 00007FF73A543A71

Part of subcall function 00007FF73A542610: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF73A547233,?,?,?,?,?,?,?,?,?,?,?,00007FF73A54101D), ref: 00007FF73A542644
Part of subcall function 00007FF73A542610: MessageBoxW.USER32 ref: 00007FF73A54271C

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF73A543AAA
Failed to get executable path., xrefs: 00007FF73A543A7B
GetModuleFileNameW, xrefs: 00007FF73A543A82

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 1c9edb799956f43a69bcedd1b9a00334b54fc6e72bcb62656acab3b705975844
Instruction ID: 441049ac2f0fe0e25bf3087d486861236737f8f69f406182ffcbb0e50314efb9
Opcode Fuzzy Hash: 1c9edb799956f43a69bcedd1b9a00334b54fc6e72bcb62656acab3b705975844
Instruction Fuzzy Hash: 0C01F718B5C71361FE60BB21E80B3B9A351BF5A7D4FD01471D90D862E2FE1CE204A720

Function 00007FF73A560CAC Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A560CED
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A560D6D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A560DC1
_get_daylight.LIBCMT ref: 00007FF73A560E19

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 37c70a1ef6a079ec95ee04a40b31ce5c5df444ed978d8de4477b5a7606ce7098
Instruction ID: cb533e7dd9c3ea6fcaaac53284de7bc218f0c19d4a12ab657cfb3e298f1c4d58
Opcode Fuzzy Hash: 37c70a1ef6a079ec95ee04a40b31ce5c5df444ed978d8de4477b5a7606ce7098
Instruction Fuzzy Hash: 7251C33BD0C212A2F7657928941337EE660DB42714F99D6B5DA0E462E6CF3CFC40E661

Function 00007FF73A541F60 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF73A541F94
SetWindowLongPtrW.USER32 ref: 00007FF73A541FB6
GetWindowLongPtrW.USER32 ref: 00007FF73A541FE0
InvalidateRect.USER32 ref: 00007FF73A542000

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4a3e62a95b454dadb353150d352b283421c9113fe456df8e506f44dbb2775c65
Instruction ID: edea9352cc9b42f96d9ea267349a870e2853914861ba27cfa4d92fd7a9e2ff04
Opcode Fuzzy Hash: 4a3e62a95b454dadb353150d352b283421c9113fe456df8e506f44dbb2775c65
Instruction Fuzzy Hash: 6811E925F1816252F754AF6AF5462B99391FF86BC0FD45070E94D06B99DE2CD4819320

Function 00007FF73A54DD10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54DD46
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54DF0E

Strings

, xrefs: 00007FF73A54DE96

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: 7b11439edd9adaac7c4e013e5372446c9314c2fb78d936ab9d4898aaada9fb84
Instruction ID: 0f835661a3568d8c3c2e08a5664bc2b8a2275b4fe9e09656bb91f8af4aeaf902
Opcode Fuzzy Hash: 7b11439edd9adaac7c4e013e5372446c9314c2fb78d936ab9d4898aaada9fb84
Instruction Fuzzy Hash: 2151977B90C626A6F764AF24C04637CB7B1EB27B08FB51275CA0A46295CF2CD495E720

Function 00007FF73A558C64 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A558CA7

Strings

gfff, xrefs: 00007FF73A558DC9
e+000, xrefs: 00007FF73A558D4C

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 9b165a6006e8c8b6c2028c6ade3b602bb750e690e74d828472ce81c508c8919f
Instruction ID: f1f469a4dde2e236f893322cbc75a47d7bf841dc9f544c543023a8feb0ec1611
Opcode Fuzzy Hash: 9b165a6006e8c8b6c2028c6ade3b602bb750e690e74d828472ce81c508c8919f
Instruction Fuzzy Hash: C0515AA6B183C596FB209B359842369BBD1E752B90F8882B1D69D4BBD5CE3CE044D710

Function 00007FF73A5448D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

mbstowcs.LIBCMT ref: 00007FF73A5449B7

Strings

pyi-, xrefs: 00007FF73A54496C
Failed to convert Wflag %s using mbstowcs (invalid multibyte string), xrefs: 00007FF73A544AD2

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: mbstowcs
String ID: Failed to convert Wflag %s using mbstowcs (invalid multibyte string)$pyi-
API String ID: 103190477-3625900369
Opcode ID: aed045b625ebf3905c0aff7a32b24a02301d8b5edd0b4d444675b66f29e8e204
Instruction ID: 5140f4a93c54ff3a875cd98a0c34092e14e803d94735cfa4808da163ea196124
Opcode Fuzzy Hash: aed045b625ebf3905c0aff7a32b24a02301d8b5edd0b4d444675b66f29e8e204
Instruction Fuzzy Hash: 6751D6A9A0861266FB14BB25E413379A3A1EF87B90FD081B5E90D473D7CE3DE541A370

Function 00007FF73A5539A8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A5539DA

Part of subcall function 00007FF73A5559CC: RtlFreeHeap.NTDLL ref: 00007FF73A5559E2

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF73A54A6C5), ref: 00007FF73A5539F8

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00007FF73A5539E6

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: FileFreeHeapModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\file.exe
API String ID: 13503096-4010620828
Opcode ID: ff5796dd5e04d12419cff41d6bf4f0ab72f95968fed81c257b5093fab464f084
Instruction ID: bc5b735ac577318c44b2c039676350cd750e45e5addb020a8fa01fa754581b84
Opcode Fuzzy Hash: ff5796dd5e04d12419cff41d6bf4f0ab72f95968fed81c257b5093fab464f084
Instruction Fuzzy Hash: 8641AFBAA09712A5FB15EF22E4520BCB7A4EB467A0B944075F94F47B85DE3DE440D320

Function 00007FF73A5574EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF73A557603
GetLastError.KERNEL32 ref: 00007FF73A557625

Strings

U, xrefs: 00007FF73A5575AF

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f42627c61a7f25b683248ff20e1504dd0ed5ade7a377c0ec61c80a04a1b4700a
Instruction ID: 61a3752cbb77497d2de8af31d0dd714218fb68fb21d4bc2abafad7a0000b3358
Opcode Fuzzy Hash: f42627c61a7f25b683248ff20e1504dd0ed5ade7a377c0ec61c80a04a1b4700a
Instruction Fuzzy Hash: 9F410572B18A4192EB20AF25E4453A9A7A0FB9A784F804431EE4E83784EF3CD401D750

Function 00007FF73A559DD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF73A559E14
GetCurrentDirectoryW.KERNEL32 ref: 00007FF73A559E66

Strings

:, xrefs: 00007FF73A559E2A

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 8dbb80ec949ec60cab1c60ad8598b610b4bb455823acfbf7583d5a07575f9295
Instruction ID: fa656571c7eaa6076a04e0e740e04fbf678b8d3d7e60ca1c761be624f1121f5a
Opcode Fuzzy Hash: 8dbb80ec949ec60cab1c60ad8598b610b4bb455823acfbf7583d5a07575f9295
Instruction Fuzzy Hash: 1F21F2B6A0824291FF30AB12D04627DB3A1FB85B84FC54075EA8E43684DF7CE9459761

Function 00007FF73A542760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A547490: MultiByteToWideChar.KERNEL32 ref: 00007FF73A5474CA

MessageBoxW.USER32 ref: 00007FF73A542831
MessageBoxA.USER32 ref: 00007FF73A54284D

Strings

Fatal error detected, xrefs: 00007FF73A542805, 00007FF73A54283F

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: 2b61138d8ba7e34161e8adb61536ce26b4d2be66a0e24b62ca542749820394dc
Instruction ID: d2d233c8787d37cb480570fdabce8ba2ef24bf2a5ced216911259e1f9cb291b7
Opcode Fuzzy Hash: 2b61138d8ba7e34161e8adb61536ce26b4d2be66a0e24b62ca542749820394dc
Instruction Fuzzy Hash: 6621CB76728792A1FB20AB10F4527EAA354FB85788FD05035EA8D47A99DF3CD205D710

Function 00007FF73A542870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A547490: MultiByteToWideChar.KERNEL32 ref: 00007FF73A5474CA

MessageBoxW.USER32 ref: 00007FF73A542941
MessageBoxA.USER32 ref: 00007FF73A54295D

Strings

Error detected, xrefs: 00007FF73A542915, 00007FF73A54294F

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 5ed7caf57bd188301ead484277fc77409bb9e70f87c7d7e6d20278c1c0f354ae
Instruction ID: a5f916ef5c9cdc0fb6d8826c2b44540449c5d0bea388ff604536f61c5fe76a80
Opcode Fuzzy Hash: 5ed7caf57bd188301ead484277fc77409bb9e70f87c7d7e6d20278c1c0f354ae
Instruction Fuzzy Hash: D021D876728782A1FB30AB10F4523EAA350FB85788FD05035EA8D07A99DF3CD204D750

Function 00007FF73A55982C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF73A559865
CompareStringW.KERNEL32 ref: 00007FF73A5598ED

Strings

CompareStringEx, xrefs: 00007FF73A559848, 00007FF73A559859

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: CompareStringtry_get_function
String ID: CompareStringEx
API String ID: 3328479835-2590796910
Opcode ID: 29c81749be49492956bf448d50416fb18953341cf3f470c3aeb53833f47193c7
Instruction ID: 25980a1ebc982c48e8def85ad665d34524aa6dc935c6c2a98459d96e4558d8c3
Opcode Fuzzy Hash: 29c81749be49492956bf448d50416fb18953341cf3f470c3aeb53833f47193c7
Instruction Fuzzy Hash: 19113E76A08B8196EB60DF15F4412AAB7A1FB8ABD0F544136EE8D43B19CF3CD4508B40

Function 00007FF73A559A98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF73A559AD1
LCMapStringW.KERNEL32 ref: 00007FF73A559B59

Strings

LCMapStringEx, xrefs: 00007FF73A559AB4, 00007FF73A559AC5

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 938b4cabf045120e554f7056953f86ac9635c27825e0d85b6221573e9749b67b
Instruction ID: 62ff015b33430b4a47e2342e4d76a10c0dbe51f056fb6ff1f145cd0366cbb430
Opcode Fuzzy Hash: 938b4cabf045120e554f7056953f86ac9635c27825e0d85b6221573e9749b67b
Instruction Fuzzy Hash: 9B112C36608B8196EB60DF15F4412AAF7A1FB89B90F944136EA8D43B19CF3CD5408B40

Function 00007FF73A55A7E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55A818

Strings

:, xrefs: 00007FF73A55A830

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: :
API String ID: 3215553584-336475711
Opcode ID: ac9e6cf1ee5af4ee396f22b42a5cc566f50753507a16ff94a4f2570f0bd7836c
Instruction ID: acaf4040ef9a757e5e96ad4b7d8a396fc99f7c991ee9940182eecd34f3ed4e30
Opcode Fuzzy Hash: ac9e6cf1ee5af4ee396f22b42a5cc566f50753507a16ff94a4f2570f0bd7836c
Instruction Fuzzy Hash: 6A01DBA690C202A5FB24BFA0945717EA3A0FF4A744FD01075EA4E46695EF3CE5099B24

Function 00007FF73A559A34 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF73A559A65
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,-00000018,00007FF73A555D0E,?,?,?,00007FF73A555C06,?,?,?,00007FF73A550C32,?,?,00000000,00007FF73A543BA9), ref: 00007FF73A559A7F

Strings

InitializeCriticalSectionEx, xrefs: 00007FF73A559A59

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: ea2b473bdb4af6d4d3061d9ce177a635df04aaff899401cb1b17dfcad325bad1
Instruction ID: be1c71e2a97ee7edec3e046a3846f02f1d41b74ad1969a5f6385e8df2de6f29f
Opcode Fuzzy Hash: ea2b473bdb4af6d4d3061d9ce177a635df04aaff899401cb1b17dfcad325bad1
Instruction Fuzzy Hash: B8F0B429B18741A1FA146F41F4420A4A321AF49B80FC460B5EA1E03B24CF3CD845D760

Function 00007FF73A5599E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF73A559A09
TlsSetValue.KERNEL32(?,?,00000000,00007FF73A5586AA,?,?,00000000,00007FF73A54FC79,?,?,?,?,00007FF73A5559F1), ref: 00007FF73A559A20

Strings

FlsSetValue, xrefs: 00007FF73A5599F6

Memory Dump Source

Source File: 00000000.00000002.1368151421.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000000.00000002.1368131384.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368178771.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368203900.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368244739.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73a540000_file.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: df5f7d63849f41ae9f7569e8dc870c87d44edfa89a3ce8aff31ae8955888d4c4
Instruction ID: b7be9c8c285cc4fdaa6b7db771b736466e973a544e9ecc8500615253961bb43d
Opcode Fuzzy Hash: df5f7d63849f41ae9f7569e8dc870c87d44edfa89a3ce8aff31ae8955888d4c4
Instruction Fuzzy Hash: 43E065A9A18642A2FE056F55F4060B4E322EF49780FC851B2E51E06364CF3CE894E370

Analysis Process: file.exePID: 792, Parent PID: 5840COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.7%
Total number of Nodes:	1072
Total number of Limit Nodes:	79

Executed Functions

Function 00007FFB1C4C1956 Relevance: 46.3, APIs: 18, Strings: 8, Instructions: 785COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_cipher.LIBCRYPTO-1_1 ref: 00007FFB1C4D03E5
EVP_CIPHER_flags.LIBCRYPTO-1_1 ref: 00007FFB1C4D03ED
EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FFB1C4D05CB
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FFB1C4D05D3
CRYPTO_memcmp.LIBCRYPTO-1_1 ref: 00007FFB1C4D0639

Strings

HEAD , xrefs: 00007FFB1C4D0C73
CONNE, xrefs: 00007FFB1C4D0CA6
POST , xrefs: 00007FFB1C4D0C55
PUT , xrefs: 00007FFB1C4D0C92
GET , xrefs: 00007FFB1C4D0C32
..\s\ssl\record\ssl3_record.c, xrefs: 00007FFB1C4D046C, 00007FFB1C4D0CC6, 00007FFB1C4D0D6E
, xrefs: 00007FFB1C4D0552
@, xrefs: 00007FFB1C4D07AD

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_sizeO_memcmpR_flagsX_cipherX_md
String ID: $..\s\ssl\record\ssl3_record.c$@$CONNE$GET $HEAD $POST $PUT
API String ID: 2456506815-352295518
Opcode ID: 98b90d3d05a1d85506967a095e1d0a1fea7bf08248ddf54c083beebe1e76f369
Instruction ID: b305c6f3e6c3f6aa181848c6a09a6471abb42c8d5fec4b06c00e42a93a2d76b5
Opcode Fuzzy Hash: 98b90d3d05a1d85506967a095e1d0a1fea7bf08248ddf54c083beebe1e76f369
Instruction Fuzzy Hash: B3729EF2B0CA4285FB209E21E4487F927A2EB55BECF644136DA4D8B695CF7CE594C700

Function 00007FF73A541B80 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDialogBaseUnits.USER32 ref: 00007FF73A541BCE
MulDiv.KERNEL32 ref: 00007FF73A541BE2
MulDiv.KERNEL32 ref: 00007FF73A541C03
SystemParametersInfoW.USER32 ref: 00007FF73A541C4B
CreateFontIndirectW.GDI32 ref: 00007FF73A541C5F
#380.COMCTL32 ref: 00007FF73A541C83
CreateWindowExW.USER32 ref: 00007FF73A541CD6
CreateWindowExW.USER32 ref: 00007FF73A541D30
CreateWindowExW.USER32 ref: 00007FF73A541D8D
CreateWindowExW.USER32 ref: 00007FF73A541DEF
SendMessageW.USER32 ref: 00007FF73A541E0F
SendMessageW.USER32 ref: 00007FF73A541E29
SendMessageW.USER32 ref: 00007FF73A541E48
SendMessageW.USER32 ref: 00007FF73A541E67
SendMessageW.USER32 ref: 00007FF73A541E85
SendMessageW.USER32 ref: 00007FF73A541EA3
SendMessageW.USER32 ref: 00007FF73A541EC1
SendMessageW.USER32 ref: 00007FF73A541ED9
SendMessageW.USER32 ref: 00007FF73A541EF1
GetClientRect.USER32 ref: 00007FF73A541F00

Part of subcall function 00007FF73A542020: GetDC.USER32 ref: 00007FF73A54204B
Part of subcall function 00007FF73A542020: SelectObject.GDI32 ref: 00007FF73A542096
Part of subcall function 00007FF73A542020: DrawTextW.USER32 ref: 00007FF73A5420B9
Part of subcall function 00007FF73A542020: SelectObject.GDI32 ref: 00007FF73A5420CF
Part of subcall function 00007FF73A542020: ReleaseDC.USER32 ref: 00007FF73A5420DF
Part of subcall function 00007FF73A542020: MoveWindow.USER32 ref: 00007FF73A54212F
Part of subcall function 00007FF73A542020: MoveWindow.USER32 ref: 00007FF73A54216F
Part of subcall function 00007FF73A542020: MoveWindow.USER32 ref: 00007FF73A5421C2

Strings

EDIT, xrefs: 00007FF73A541D3B
Close, xrefs: 00007FF73A541D98
STATIC, xrefs: 00007FF73A541C8C, 00007FF73A541CE1
BUTTON, xrefs: 00007FF73A541DA6
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF73A541BAD

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 405cae881102fd9b4288b25694fdcb7e510b233441f66b6cc7a0f1c85a4d260d
Instruction ID: d5269ba1f7c33a40c1017869300e098ad03e299b0d7bab99b2a5005f597a8529
Opcode Fuzzy Hash: 405cae881102fd9b4288b25694fdcb7e510b233441f66b6cc7a0f1c85a4d260d
Instruction Fuzzy Hash: FFA17A3A218B8197E7149F21E45579EB770F789B90FA05129EB8D03B24CF7DE1A4CB50

Function 00007FFB1C4C2207 Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E4C9D
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E4CEF
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E4D14

Strings

TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256, xrefs: 00007FFB1C4E4E45
ALL:!COMPLEMENTOFDEFAULT:!eNULL, xrefs: 00007FFB1C4E4E77
ssl3-sha1, xrefs: 00007FFB1C4E4EDF
ssl3-md5, xrefs: 00007FFB1C4E4EB7
..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4E4C93, 00007FFB1C4E4CDF, 00007FFB1C4E4CFF, 00007FFB1C4E4D3E, 00007FFB1C4E4D9E, 00007FFB1C4E4DC4, 00007FFB1C4E4F53

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c$ALL:!COMPLEMENTOFDEFAULT:!eNULL$TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$ssl3-md5$ssl3-sha1
API String ID: 1767461275-1115027282
Opcode ID: 9251dc2895a427f5c48691cc63dd2dbf7ccfd2633b23681e461f42e7413bf57a
Instruction ID: 3945b3b1e68cc44cfaae095dfbbb9e0c0eba83cf6292a8b1ef670d508c86838b
Opcode Fuzzy Hash: 9251dc2895a427f5c48691cc63dd2dbf7ccfd2633b23681e461f42e7413bf57a
Instruction Fuzzy Hash: 9EA124E2A09F4281EB509F71D01A7E823A2EF44B68F690135DA4D4B396EF3CE654C225

Function 00007FFB1C4C214E Relevance: 36.8, APIs: 20, Strings: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E4830
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E4854
CRYPTO_free_ex_data.LIBCRYPTO-1_1 ref: 00007FFB1C4E488B
OPENSSL_LH_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E4894
X509_STORE_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E489D
CTLOG_STORE_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E48A9
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E48B2
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E48BB
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E48C4
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E48E3
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E48F6
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E4909
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E4920
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FFB1C4E4934
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E494D
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E4966
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E497F
CRYPTO_secure_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E4998
CRYPTO_THREAD_lock_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E49A4
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E49B9

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4E4823, 00007FFB1C4E483C, 00007FFB1C4E4940, 00007FFB1C4E4959, 00007FFB1C4E4972, 00007FFB1C4E498B, 00007FFB1C4E49AF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$L_sk_free$L_sk_pop_free$E_free$D_lock_freeE_finishH_freeO_free_ex_dataO_secure_freeX509_
String ID: ..\s\ssl\ssl_lib.c
API String ID: 4271332762-1080266419
Opcode ID: b41bb85c42152f97209149f98d03c6eb662aba0c9ec14962aaee1a7af4300c41
Instruction ID: 796847034676d541bf220600a7a93a6a60a1ba15208a9d80b9751f03d806c83c
Opcode Fuzzy Hash: b41bb85c42152f97209149f98d03c6eb662aba0c9ec14962aaee1a7af4300c41
Instruction Fuzzy Hash: C441FBE1A08E42C0FB40AF71D45A7F823A2EF85BA8F685131ED0D4B2AADF6DD545C351

Function 00007FFB1C4C1393 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FFB1C50E807
d2i_X509.LIBCRYPTO-1_1 ref: 00007FFB1C50E919
X509_free.LIBCRYPTO-1_1 ref: 00007FFB1C50ED81
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C50ED90

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50E8BB, 00007FFB1C50ED5C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pop_freeX509X509_freed2i_
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 1068509327-1507966698
Opcode ID: 61273607212596b606150630d1837e3114aafc33daa6e4ab01bc42111a15e5b1
Instruction ID: 5ccfd407724eb73cca9b0a98b85c837d49b77da7d70bad0c9d78084e60bcad94
Opcode Fuzzy Hash: 61273607212596b606150630d1837e3114aafc33daa6e4ab01bc42111a15e5b1
Instruction Fuzzy Hash: 6FE1F3F2A08E8182E7608B25D4493E97792FB45BA8F344135EE8C8BB95DF7CD561D700

Function 00007FFB1C4C1073 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E331A
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FFB1C4E3359
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FFB1C4E3384
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FFB1C4E33AD

Strings

..\s\ssl\ssl_init.c, xrefs: 00007FFB1C4E32F5

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_run_once$R_put_error
String ID: ..\s\ssl\ssl_init.c
API String ID: 511881677-1166085723
Opcode ID: db70cd3fe9124d3be5843a5cb51397eff7ea31a0ddd807d1c2b454ce1f023e85
Instruction ID: 8495ff0dfbf6e33f9db1f0fd3033d8d6246fc4a929ba0c6386851d88f612a248
Opcode Fuzzy Hash: db70cd3fe9124d3be5843a5cb51397eff7ea31a0ddd807d1c2b454ce1f023e85
Instruction Fuzzy Hash: C92175F1B0DA0386FB01CB75E84A6F92393AF857A8F694134D90D82196DF3CFA55C600

Function 00007FFB1E673310 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 181
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ffi_prep_cif.LIBFFI-7 ref: 00007FFB1E673374
ffi_call.LIBFFI-7 ref: 00007FFB1E6733DF
PyErr_Occurred.PYTHON310 ref: 00007FFB1E673439
PyEval_SaveThread.PYTHON310 ref: 00007FFB1E673461
PyErr_SetString.PYTHON310 ref: 00007FFB1E677CBC
PyErr_SetFromWindowsErr.PYTHON310 ref: 00007FFB1E677CC7
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1E677CFA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB1E677D09

Strings

exception: breakpoint encountered, xrefs: 00007FFB1E677CAB
ffi_prep_cif failed, xrefs: 00007FFB1E677C9B
exception: access violation reading %p, xrefs: 00007FFB1E677E18
ctypes.seh_exception, xrefs: 00007FFB1E677DA0
exception: datatype misalignment, xrefs: 00007FFB1E677DEF
exception: access violation writing %p, xrefs: 00007FFB1E677E2A
No ffi_type for result, xrefs: 00007FFB1E677C92
exception: single step, xrefs: 00007FFB1E677DE3

Memory Dump Source

Source File: 00000002.00000002.1366824245.00007FFB1E671000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1E670000, based on PE: true

Associated: 00000002.00000002.1366794177.00007FFB1E670000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1366852178.00007FFB1E680000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1366884646.00007FFB1E687000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1366916098.00007FFB1E68B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1e670000_file.jbxd

Similarity

API ID: Err_$_errno$Eval_FromOccurredSaveStringThreadWindowsffi_callffi_prep_cif
String ID: No ffi_type for result$ctypes.seh_exception$exception: access violation reading %p$exception: access violation writing %p$exception: breakpoint encountered$exception: datatype misalignment$exception: single step$ffi_prep_cif failed
API String ID: 1937973484-2749438402
Opcode ID: 250959da6876043cdb6e2a33e241b816906fe06eabaca877a4c7677853cc964e
Instruction ID: bd10cbdad38e912d04bcc8caf6e2870988aaee340b7aca74d6e924051bdb7815
Opcode Fuzzy Hash: 250959da6876043cdb6e2a33e241b816906fe06eabaca877a4c7677853cc964e
Instruction Fuzzy Hash: C1812EB2E08F8286E6A58F21DC446796762FF44BB5FA04535DA5E63698DF3CF844C700

Function 00007FFB1E672A70 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyTuple_GetItem.PYTHON310 ref: 00007FFB1E67740C
PyErr_SetString.PYTHON310 ref: 00007FFB1E677439

Strings

native com method call without 'this' parameter, xrefs: 00007FFB1E67741F
this function takes at least %d argument%s (%d given), xrefs: 00007FFB1E67744A
this function takes %d argument%s (%d given), xrefs: 00007FFB1E677524
COM method call without VTable, xrefs: 00007FFB1E677428
NULL COM pointer access, xrefs: 00007FFB1E6774FA
Expected a COM this pointer as first argument, xrefs: 00007FFB1E6774A0

Memory Dump Source

Source File: 00000002.00000002.1366824245.00007FFB1E671000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1E670000, based on PE: true

Associated: 00000002.00000002.1366794177.00007FFB1E670000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1366852178.00007FFB1E680000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1366884646.00007FFB1E687000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1366916098.00007FFB1E68B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1e670000_file.jbxd

Similarity

API ID: Err_ItemStringTuple_
String ID: COM method call without VTable$Expected a COM this pointer as first argument$NULL COM pointer access$native com method call without 'this' parameter$this function takes %d argument%s (%d given)$this function takes at least %d argument%s (%d given)
API String ID: 2162364271-1981512665
Opcode ID: 98429417ef9b090e8efcf8a06dc81c4455f73199260932cfd978a783bae73669
Instruction ID: 5747a67e220c51393d6d69170f2f16beeede5f8b81d1ec00c00cb38bb87e67d1
Opcode Fuzzy Hash: 98429417ef9b090e8efcf8a06dc81c4455f73199260932cfd978a783bae73669
Instruction Fuzzy Hash: E39139A6E09F4282EA658B35EC4067A67A6FB48FA8F944431DE8D17768DF3CF445C700

Function 00007FFB1E674DB8 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 68
threadlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON310 ref: 00007FFB1E674DDC
PySys_Audit.PYTHON310 ref: 00007FFB1E674DFD
PyUnicode_AsWideCharString.PYTHON310 ref: 00007FFB1E674E0E
PyEval_SaveThread.PYTHON310 ref: 00007FFB1E674E1C
LoadLibraryExW.KERNEL32 ref: 00007FFB1E674E2F
PyEval_RestoreThread.PYTHON310 ref: 00007FFB1E674E46
PyMem_Free.PYTHON310 ref: 00007FFB1E674E4F
PyLong_FromVoidPtr.PYTHON310 ref: 00007FFB1E674E69
GetLastError.KERNEL32 ref: 00007FFB1E679148
PyErr_Format.PYTHON310 ref: 00007FFB1E67916B
PyErr_SetFromWindowsErr.PYTHON310 ref: 00007FFB1E679179

Strings

ctypes.dlopen, xrefs: 00007FFB1E674DF6
Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax., xrefs: 00007FFB1E67915C
U|i:LoadLibrary, xrefs: 00007FFB1E674DD5

Memory Dump Source

Source File: 00000002.00000002.1366824245.00007FFB1E671000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1E670000, based on PE: true

Associated: 00000002.00000002.1366794177.00007FFB1E670000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1366852178.00007FFB1E680000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1366884646.00007FFB1E687000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1366916098.00007FFB1E68B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1e670000_file.jbxd

Similarity

API ID: Err_Eval_FromThread$Arg_AuditCharErrorFormatFreeLastLibraryLoadLong_Mem_ParseRestoreSaveStringSys_TupleUnicode_VoidWideWindows
String ID: Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax.$U|i:LoadLibrary$ctypes.dlopen
API String ID: 3805577924-808210370
Opcode ID: 62f4c16a77452745bdc73e5f2b81e91eb59c12fd83c298bc440f2f808abac652
Instruction ID: 61bb8070eda19145cafe736612a5ae825ea2ca8c4715fe08b22fc7abc089365c
Opcode Fuzzy Hash: 62f4c16a77452745bdc73e5f2b81e91eb59c12fd83c298bc440f2f808abac652
Instruction Fuzzy Hash: 7C212FA5E0CF4386FA948B75DC4897827A6AF88BF5FA44431C91E52265DF7CF489C300

Function 00007FFB1E672D30 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 277
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140 ref: 00007FFB1E672DDF
PyThreadState_Get.PYTHON310 ref: 00007FFB1E672E3F
_Py_CheckFunctionResult.PYTHON310 ref: 00007FFB1E672E97
_Py_Dealloc.PYTHON310 ref: 00007FFB1E673043
PyErr_Format.PYTHON310 ref: 00007FFB1E677A05

Strings

too many arguments (%zi), maximum is %i, xrefs: 00007FFB1E6779F5
argument %zd: , xrefs: 00007FFB1E677A81

Memory Dump Source

Source File: 00000002.00000002.1366824245.00007FFB1E671000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFB1E670000, based on PE: true

Associated: 00000002.00000002.1366794177.00007FFB1E670000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1366852178.00007FFB1E680000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1366884646.00007FFB1E687000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1366916098.00007FFB1E68B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1e670000_file.jbxd

Similarity

API ID: CheckDeallocErr_FormatFunctionResultState_Threadmemset
String ID: argument %zd: $too many arguments (%zi), maximum is %i
API String ID: 593911088-4072972272
Opcode ID: a7178a39f3fb075eac8c8b421ebfe36309caa24a9e25969d7f13be4fd88e8685
Instruction ID: 9af09811481eb610727807d565af3cd625c83907f5e3f45521ee63021bb0a667
Opcode Fuzzy Hash: a7178a39f3fb075eac8c8b421ebfe36309caa24a9e25969d7f13be4fd88e8685
Instruction Fuzzy Hash: 6AC16EA2E08F8285EA608F35DC416A923A2FF05BB4F944631EA6D677D9DF3CF5458300

Function 00007FF73A5417A0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF73A54184C
_fread_nolock.LIBCMT ref: 00007FF73A5418FE

Part of subcall function 00007FF73A54C954: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54C968

Part of subcall function 00007FF73A542760: MessageBoxW.USER32 ref: 00007FF73A542831

Strings

Error on file., xrefs: 00007FF73A54192D
fseek, xrefs: 00007FF73A541826
Failed to read cookie!, xrefs: 00007FF73A541857
MEI, xrefs: 00007FF73A5417DF
malloc, xrefs: 00007FF73A5418DA
fread, xrefs: 00007FF73A54185E
Could not read full TOC!, xrefs: 00007FF73A541909
Cannot read Table of Contents., xrefs: 00007FF73A541985
Could not allocate buffer for TOC!, xrefs: 00007FF73A5418D3
Failed to seek to cookie position!, xrefs: 00007FF73A54181F

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: 149db1fb0c862d280083199d493ba4feb4dde98aef295f2547f5d5c3ca91903e
Instruction ID: da3c6c5bbef71cbee0f478753b70c49d9e5bc0510db7f41ea9f9a8cb64a76f19
Opcode Fuzzy Hash: 149db1fb0c862d280083199d493ba4feb4dde98aef295f2547f5d5c3ca91903e
Instruction Fuzzy Hash: 7A51E4B6A09A12A6FB54EF25D45217CB3A0FF8AB48BE09175D90D83399DF3CE404D760

Function 00007FF73A542020 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32 ref: 00007FF73A54204B
SelectObject.GDI32 ref: 00007FF73A542096
DrawTextW.USER32 ref: 00007FF73A5420B9
SelectObject.GDI32 ref: 00007FF73A5420CF
ReleaseDC.USER32 ref: 00007FF73A5420DF
MoveWindow.USER32 ref: 00007FF73A54212F
MoveWindow.USER32 ref: 00007FF73A54216F
MoveWindow.USER32 ref: 00007FF73A5421C2
MoveWindow.USER32 ref: 00007FF73A54220A

Strings

P%, xrefs: 00007FF73A5420A3

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: aae4e62fcfd093211e570d6b90d2c8fdd41e88a62d8dc34d7df732e47f0cc643
Instruction ID: f9f85d7e0333555021088a72fd3bfd41950f6dc34697d8dfa9f0a00321caf27b
Opcode Fuzzy Hash: aae4e62fcfd093211e570d6b90d2c8fdd41e88a62d8dc34d7df732e47f0cc643
Instruction Fuzzy Hash: 625106366187A186E6349F26B0181BAF7A1FB98BA1F404125EFCE43694DF7CD085DB20

Function 00007FFB1C4C146A Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FFB1C50652A
SetLastError.KERNEL32 ref: 00007FFB1C506531
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C506637
BUF_MEM_grow.LIBCRYPTO-1_1 ref: 00007FFB1C5066C2
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C506709
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C50683E
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C506891
BUF_MEM_free.LIBCRYPTO-1_1 ref: 00007FFB1C50689F

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FFB1C506627, 00007FFB1C5066F9, 00007FFB1C50682E, 00007FFB1C506881

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error$ErrorLastM_freeM_growR_clear_error
String ID: ..\s\ssl\statem\statem.c
API String ID: 2562538362-2512360314
Opcode ID: 24ffbacb5d09be5227024975eccb736be33be923be713300eb13547a33ae7f65
Instruction ID: 670c9d6d96812544de085ba790ec012b4726ee8bf0e4f794a50ceef165fff0f1
Opcode Fuzzy Hash: 24ffbacb5d09be5227024975eccb736be33be923be713300eb13547a33ae7f65
Instruction Fuzzy Hash: EEB161F1A08A4286F7A49F35C44A3F823E2EF40B68F744535DE4986695DF3DE8A4C721

Function 00007FFB1C4C1B45 Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 569COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FFB1C4CC819
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FFB1C4CC826
memcpy.VCRUNTIME140 ref: 00007FFB1C4CC864
memcpy.VCRUNTIME140 ref: 00007FFB1C4CC9FD

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFB1C4CCB0F, 00007FFB1C4CCCBA
SSL alert number , xrefs: 00007FFB1C4CCB43

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: memcpy$O_clear_flagsO_set_flags
String ID: ..\s\ssl\record\rec_layer_s3.c$SSL alert number
API String ID: 1692547093-34800109
Opcode ID: 46ef9a184c9182c3569b711b01a24bee71a38eb913ee1f191aad482e361ef3c9
Instruction ID: a7a76b14ad847fb098d0fb432f480b1ab8dc89c2500b9ab7610e59876595910a
Opcode Fuzzy Hash: 46ef9a184c9182c3569b711b01a24bee71a38eb913ee1f191aad482e361ef3c9
Instruction Fuzzy Hash: 8E4293F1A0DA4286EB748A25D5483F966A2FF457A8F244135CA4E47AA2CF3DE471870C

Function 00007FF73A5412B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fseek, xrefs: 00007FF73A541319
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF73A54134C
malloc, xrefs: 00007FF73A541353
fread, xrefs: 00007FF73A5413E9
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF73A5413E2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF73A541312
Failed to extract %s: failed to open archive file!, xrefs: 00007FF73A5412E2

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: f1e9d0a81f44e36b4cb67dafe942d4350b2034c4e5369f0bac84933451294020
Instruction ID: a852c86d1a59e4bf82c9fccbb13a6ae86df7602f6c63f61c35351b4f6dddf059
Opcode Fuzzy Hash: f1e9d0a81f44e36b4cb67dafe942d4350b2034c4e5369f0bac84933451294020
Instruction Fuzzy Hash: 0D41B329B48662A2FA14FB16E4022B9E3A0FF427D4FE45472DE4D47B55EE3CE441E320

Function 00007FF73A560F7C Relevance: 13.8, APIs: 9, Instructions: 273
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73A560CAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A560CED
Part of subcall function 00007FF73A560CAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A560D6D
Part of subcall function 00007FF73A560CAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A560DC1
Part of subcall function 00007FF73A560CAC: _get_daylight.LIBCMT ref: 00007FF73A560E19

CreateFileW.KERNEL32 ref: 00007FF73A561082
CreateFileW.KERNEL32 ref: 00007FF73A5610D2
GetLastError.KERNEL32 ref: 00007FF73A561102
GetFileType.KERNEL32 ref: 00007FF73A561117
GetLastError.KERNEL32 ref: 00007FF73A561121
CloseHandle.KERNEL32 ref: 00007FF73A561154
CloseHandle.KERNEL32 ref: 00007FF73A5612AF
CreateFileW.KERNEL32 ref: 00007FF73A5612E4
GetLastError.KERNEL32 ref: 00007FF73A5612F3

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: d121c7e434188e1b59c11ae7c5eb2a34e011b9b37a129bdee774847c0c4b5b89
Instruction ID: c2e9bef5e8f7cfed8cbf2f6e2a41878d0cc8809ad7bd505aaac40167fd3e0c39
Opcode Fuzzy Hash: d121c7e434188e1b59c11ae7c5eb2a34e011b9b37a129bdee774847c0c4b5b89
Instruction Fuzzy Hash: B1C1D13BB28A4296FB10DF68C4821BC7761FB4AB98B905265DE5E877E4CF38D051D310

Function 00007FF73A541000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A543A40: GetModuleFileNameW.KERNEL32(?,00007FF73A54353B), ref: 00007FF73A543A71

SetDllDirectoryW.KERNEL32 ref: 00007FF73A543747

Part of subcall function 00007FF73A5464E0: GetEnvironmentVariableW.KERNEL32(00007FF73A543589), ref: 00007FF73A54651A
Part of subcall function 00007FF73A5464E0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF73A546537

Strings

Cannot side-load external archive %s (code %d)!, xrefs: 00007FF73A5436CE
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF73A543630
Failed to convert DLL search path!, xrefs: 00007FF73A54372F
MEI, xrefs: 00007FF73A543689
_MEIPASS2, xrefs: 00007FF73A543575, 00007FF73A5435DE, 00007FF73A54388B, 00007FF73A54389B
_PYI_ONEDIR_MODE, xrefs: 00007FF73A54359E, 00007FF73A5435C9

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 3b1d6f2ee4ddef313709664c18f964ba635afb2ce722f88ee5dc889817fa13d4
Instruction ID: 436599741f618e4a96b5598025bec94db2198157b7d6499c8a65d6d5a917189a
Opcode Fuzzy Hash: 3b1d6f2ee4ddef313709664c18f964ba635afb2ce722f88ee5dc889817fa13d4
Instruction Fuzzy Hash: 61B1E969A1C6A371FA24BB21D4532FDE350BF52794FE00071EA4D477A6EE2CE605E720

Function 00007FF73A541050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON

Download Yara Rule

Strings

1.2.11, xrefs: 00007FF73A54107E
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF73A541249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF73A5410B4
malloc, xrefs: 00007FF73A5410F8, 00007FF73A541126
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF73A54111F
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF73A5410F1

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: Message
String ID: 1.2.11$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1060636955
Opcode ID: a9bacd6be3711d35ecb69e520e7de468e0dec868e9aee55fa6e056ffc73a1036
Instruction ID: 7b3d111833752b22a4c4219404a1346f1b1e53e58f8a62bc509ea3a5af0cfe67
Opcode Fuzzy Hash: a9bacd6be3711d35ecb69e520e7de468e0dec868e9aee55fa6e056ffc73a1036
Instruction Fuzzy Hash: B651086AA0C662A5F660BB12E4423B9E391FB86794FE44171EE4D87795EF3CE404E310

Function 00007FF73A556408 Relevance: 10.8, APIs: 7, Instructions: 291COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55683E

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 53787f42cc88ec762c7cab538ca08b13a4b27a7d8075f21ba4fa32834bd05f71
Instruction ID: a32e1a26c7be86980837f0b10651d4f3313a4b052090f05af1e5fb793b7bb5f4
Opcode Fuzzy Hash: 53787f42cc88ec762c7cab538ca08b13a4b27a7d8075f21ba4fa32834bd05f71
Instruction Fuzzy Hash: EBC1E6AAA0D687A5FA606F14904227DFB91EF42B80FD90171E94F07B91CF7CE455E360

Function 00007FFB1C4C1497 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFB1C4CD02E
memcpy.VCRUNTIME140 ref: 00007FFB1C4CD085
SetLastError.KERNEL32 ref: 00007FFB1C4CD185
BIO_read.LIBCRYPTO-1_1 ref: 00007FFB1C4CD1AC

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFB1C4CD131, 00007FFB1C4CD225

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: memcpy$ErrorLastO_read
String ID: ..\s\ssl\record\rec_layer_s3.c
API String ID: 1958097105-2209325370
Opcode ID: 1b9168cf4ee550c2999c879796d4dd2d2debaa1538060dc2fa35bbe61a5704c8
Instruction ID: 8003e621ed62f807e8a1d995e60575d7ff5723e25030e85d1406388ff78b0907
Opcode Fuzzy Hash: 1b9168cf4ee550c2999c879796d4dd2d2debaa1538060dc2fa35bbe61a5704c8
Instruction Fuzzy Hash: D5816FF1A0DE8581EB509E35D4483F966A2FF44BACF288135DE8C07AA9DF38D456C349

Function 00007FF73A542230 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF73A54241F), ref: 00007FF73A542268
DialogBoxIndirectParamW.USER32 ref: 00007FF73A54232C
DeleteObject.GDI32 ref: 00007FF73A54235F
DestroyIcon.USER32 ref: 00007FF73A542371

Strings

Unhandled exception in script, xrefs: 00007FF73A542298

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 2617642130cb3c2885c8050bcfcfe7c95971074e5b05e943a74e7e47920840ec
Instruction ID: a6a274f996216ab0522bcf646a582d56b2e27d0047dc3301c54f72878dba9b8e
Opcode Fuzzy Hash: 2617642130cb3c2885c8050bcfcfe7c95971074e5b05e943a74e7e47920840ec
Instruction Fuzzy Hash: DE318076A08A9295FB20EF21E8521F9B360FF8A784F900175EA4E4BA55DF3CD105D710

Function 00007FF73A54A754 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF73A54A763

Part of subcall function 00007FF73A54ABB4: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF73A54ABD6

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF73A54A778
__scrt_release_startup_lock.LIBCMT ref: 00007FF73A54A7E6
__scrt_get_show_window_mode.LIBCMT ref: 00007FF73A54A839
__scrt_is_managed_app.LIBCMT ref: 00007FF73A54A85C

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 4144305933-0
Opcode ID: 702f7c832cf0ba87b5ff8a943f0597e04a247d80620e40057ef95aeb345a1c99
Instruction ID: bd545f7bb526a20ed96e625335c0a517cba0629d55836f576b9d78e4e720335f
Opcode Fuzzy Hash: 702f7c832cf0ba87b5ff8a943f0597e04a247d80620e40057ef95aeb345a1c99
Instruction Fuzzy Hash: 0631652DE4C123B1FAA4BB6194533B9A391AF53745FE440B4E74E076D3DE1CA405A330

Function 00007FFB1C505FF0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FFB1C506295, 00007FFB1C50635C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem.c
API String ID: 0-2512360314
Opcode ID: ebd041f8dc76c353a889ea9c7a90dd2bc630e7ae43785bcf39c59d47f1adca09
Instruction ID: 30d5423cb95d9b69ec5ab6f788d9fdcdc6a2ba06c1c7fa676f7ca118a731ae14
Opcode Fuzzy Hash: ebd041f8dc76c353a889ea9c7a90dd2bc630e7ae43785bcf39c59d47f1adca09
Instruction Fuzzy Hash: 2BA19BF2A08A4285EBA08F35D4593F937A2EB40B68F64403ACE4D87795CF7DE4A5C750

Function 00007FF73A541F60 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF73A541F94
SetWindowLongPtrW.USER32 ref: 00007FF73A541FB6
GetWindowLongPtrW.USER32 ref: 00007FF73A541FE0
InvalidateRect.USER32 ref: 00007FF73A542000

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4a3e62a95b454dadb353150d352b283421c9113fe456df8e506f44dbb2775c65
Instruction ID: edea9352cc9b42f96d9ea267349a870e2853914861ba27cfa4d92fd7a9e2ff04
Opcode Fuzzy Hash: 4a3e62a95b454dadb353150d352b283421c9113fe456df8e506f44dbb2775c65
Instruction Fuzzy Hash: 6811E925F1816252F754AF6AF5462B99391FF86BC0FD45070E94D06B99DE2CD4819320

Function 00007FFB1C4E6FF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E7029
ASYNC_get_current_job.LIBCRYPTO-1_1 ref: 00007FFB1C4E7076

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4E7010

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: C_get_current_jobR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 4281227279-1080266419
Opcode ID: d05052bd2380747fd6a15a2220e3b92cd885a60921ab4697ffd08b620334275a
Instruction ID: 97ef358fa96d1d039aa530c75e8b8e7e03ece4dd43d78a4fddb9405cc5a19cf3
Opcode Fuzzy Hash: d05052bd2380747fd6a15a2220e3b92cd885a60921ab4697ffd08b620334275a
Instruction Fuzzy Hash: D32162B2B0CA4282E750DB35E5052ED23A2EF84BA8F690130EA5D47396EF3CD5658A00

Function 00007FFB1C5063D6 Relevance: 4.9, APIs: 3, Instructions: 351COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FFB1C50652A
SetLastError.KERNEL32 ref: 00007FFB1C506531
BUF_MEM_free.LIBCRYPTO-1_1 ref: 00007FFB1C50689F

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: b327881a675fccba9671327b7059c0bddc028ba0526f8c7b0ac5eb704ec07ad2
Instruction ID: 27eb417ee8cc89c58f4f364299e7a9d806a3aedf9c7d23f1b005aa5cac9039fc
Opcode Fuzzy Hash: b327881a675fccba9671327b7059c0bddc028ba0526f8c7b0ac5eb704ec07ad2
Instruction Fuzzy Hash: 2531C3F2A08A0186F7A48E35C54A1B973E2EF40FA4F744435DE088774ADF38E8A1C720

Function 00007FF73A54FEE4 Relevance: 4.6, APIs: 3, Instructions: 92fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54FF15

Part of subcall function 00007FF73A5504B4: GetDriveTypeW.KERNEL32 ref: 00007FF73A550578

CreateFileW.KERNEL32 ref: 00007FF73A54FF53
CloseHandle.KERNEL32 ref: 00007FF73A54FF91

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: CloseCreateDriveFileHandleType_invalid_parameter_noinfo
String ID:
API String ID: 2907017715-0
Opcode ID: 6bc34977209249cb9a8280982b1036741a152119e2b8ccc82b4d09bdf26104ee
Instruction ID: 0e5a2275d76f517f160d9f548ae4bdc2a5f6681e746989435ae4a6a88fddfed5
Opcode Fuzzy Hash: 6bc34977209249cb9a8280982b1036741a152119e2b8ccc82b4d09bdf26104ee
Instruction Fuzzy Hash: DD310476D18791A7F610AF24A501279B750FB86BA4F504330FAAD43AD2DF3CE1A4D750

Function 00007FFB1C4C1CF3 Relevance: 4.6, APIs: 3, Instructions: 88COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FFB1C50652A
SetLastError.KERNEL32 ref: 00007FFB1C506531
BUF_MEM_free.LIBCRYPTO-1_1 ref: 00007FFB1C50689F

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: f8a07dd1d66c8d9db0fe9bc8c4b125a5f3168ff350dc40a90b84cfc8373ddd36
Instruction ID: a75e189fb7e0751d7fc2357d86f23c55578c67fdcf6d34c0cd21c620688681b1
Opcode Fuzzy Hash: f8a07dd1d66c8d9db0fe9bc8c4b125a5f3168ff350dc40a90b84cfc8373ddd36
Instruction Fuzzy Hash: AC3185F2A08A4186F7E49E35D54A1B923E2EF40B64F744431DD099778ADE39E8A5C720

Function 00007FF73A554394 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF73A554393), ref: 00007FF73A5543BD
TerminateProcess.KERNEL32(?,?,?,00007FF73A554393), ref: 00007FF73A5543C8
ExitProcess.KERNEL32 ref: 00007FF73A5543D7

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f5bd35b994d705466abf85fcadaa355dadbc0a36878a45ce859ff20c5e8e7d7d
Instruction ID: c9d919335c300bf5fb81b6d1206263cf3dce7eff6c88cf325bbe354f7fcd5f92
Opcode Fuzzy Hash: f5bd35b994d705466abf85fcadaa355dadbc0a36878a45ce859ff20c5e8e7d7d
Instruction Fuzzy Hash: B7E04868F5570163FF147B31A89727953625F56741F5165B8E80F42372CD3DE4889320

Function 00007FFB1C506AC0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 213COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1(?,?,?,?,00007FFB1C5067E4), ref: 00007FFB1C506E48

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FFB1C506E37

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\statem\statem.c
API String ID: 1767461275-2512360314
Opcode ID: dd53fd6025d0f5f0d5b0a781d4103416fa5411cc220ce5ec87aa1f86cf0ac7cd
Instruction ID: fb8ffd3cc6b398988099028f4c53323bf3c271afccd3917aa8617cf2c5638f43
Opcode Fuzzy Hash: dd53fd6025d0f5f0d5b0a781d4103416fa5411cc220ce5ec87aa1f86cf0ac7cd
Instruction Fuzzy Hash: A59169F2618A4286EBA49F35D4593F927A2FF40B68F240136DE0D876A5CF3DD854CB10

Function 00007FF73A54C980 Relevance: 3.2, APIs: 2, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54C9BC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54CAB9

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 418abc046f0238a7e4161840f51ccb75892871292d6ebbe86ace378d7f50b21f
Instruction ID: 7eb9cf2724376d746895e4645a81f577bc3d738a8edbcf3c8c86afa7cfb91c71
Opcode Fuzzy Hash: 418abc046f0238a7e4161840f51ccb75892871292d6ebbe86ace378d7f50b21f
Instruction Fuzzy Hash: E2515B69B0826165FA24FE37940A676E791BFC2BB4FA44270DD6D077C5CE3CE401B620

Function 00007FF73A556ABC Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,00007FF73A5577DF,?,?,?,?,?,?,?,?,?,?,?,00007FF73A557707), ref: 00007FF73A556B00
GetLastError.KERNEL32(?,?,?,00007FF73A5577DF,?,?,?,?,?,?,?,?,?,?,?,00007FF73A557707), ref: 00007FF73A556B0A

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 1070729c18fb5a550bb7979bd9dd777fb7470f3e740498ab44d3ee6d69d9d9f5
Instruction ID: e1a612d6df351d775876b522b43e0d4112d38a2820550f0a984705394181bf6a
Opcode Fuzzy Hash: 1070729c18fb5a550bb7979bd9dd777fb7470f3e740498ab44d3ee6d69d9d9f5
Instruction Fuzzy Hash: 8401C2A5B18A82A1FE106B25E842079B351AB46BF0F985371F93E07BE5DE3CD455A310

Function 00007FF73A555B24 Relevance: 2.6, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF73A555A57,?,?,00000000,00007FF73A555AFF,?,?,?,?,?,?,00007FF73A54C892), ref: 00007FF73A555B8A
GetLastError.KERNEL32(?,?,?,00007FF73A555A57,?,?,00000000,00007FF73A555AFF,?,?,?,?,?,?,00007FF73A54C892), ref: 00007FF73A555B94

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 482a02ddfad1f0d1748aaf476af5d25a2817b8fdf229cc618c88afa72f650b78
Instruction ID: 13687537529dc4b2463c7f4f0c3623b46b0aac5c7110169e41fd432f813bcf3d
Opcode Fuzzy Hash: 482a02ddfad1f0d1748aaf476af5d25a2817b8fdf229cc618c88afa72f650b78
Instruction Fuzzy Hash: C811B4A8B0C24261FE647B60949B37C93825F467B0FD406B5FA2F4A2C2DE6CE444A320

Function 00007FF73A556860 Relevance: 1.6, APIs: 1, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A556888

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c5dd71678ec1c3fccfd7b12bb33d50ac5b5a91bc82f8ec354b455621dbb7ad32
Instruction ID: f0b175b48e26d9f6f93145d313ab8937552f70c17b931eb538dad30f7e186191
Opcode Fuzzy Hash: c5dd71678ec1c3fccfd7b12bb33d50ac5b5a91bc82f8ec354b455621dbb7ad32
Instruction Fuzzy Hash: CF4109B6A09241A3FE14AB15D242278B3B0FB52750F840171E78F47B91CF2DE412D360

Function 00007FFB1C5060E0 Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBCRYPTO-1_1(?,?,?,?,?,-00000031,00007FFB1C5067C2), ref: 00007FFB1C50619C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: M_grow_clean
String ID:
API String ID: 964628749-0
Opcode ID: d0c7ad8d172a411e1d3243367d77037a15728a58e84304b822fe426971fd0ce6
Instruction ID: b980bb3b2b87513db57cdec8d936465e6c0f76aa491174a81f139b66d611f763
Opcode Fuzzy Hash: d0c7ad8d172a411e1d3243367d77037a15728a58e84304b822fe426971fd0ce6
Instruction Fuzzy Hash: 3A4172F2A09E8685EBA48F35D4593FD2392EB40B68F688139CE4D87799CF38D465C350

Function 00007FF73A55309C Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A5530BE

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 18b213fde59874ac87f85e5de4d39c2b719f2023920e8f19be70c6083ce6ebcb
Instruction ID: f7d305492e39acf0e89f09627890492a41cf109d57f51ce8431844da47d3fac1
Opcode Fuzzy Hash: 18b213fde59874ac87f85e5de4d39c2b719f2023920e8f19be70c6083ce6ebcb
Instruction Fuzzy Hash: 1C31C3BAE08A46A1FE10AB35C526378A7909B62FF4F844171E90F077D5DF3CE845A360

Function 00007FF73A546CF0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF73A546D9A

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: b56868ccbfe1db70a7cb4a4678a42f933a1ba7f1c77b940196a708d6758468b2
Instruction ID: 95f9b10cc90a4db90c558cdf9f13ef6a7f92c8cfac2b7b841e422fda88da10dd
Opcode Fuzzy Hash: b56868ccbfe1db70a7cb4a4678a42f933a1ba7f1c77b940196a708d6758468b2
Instruction Fuzzy Hash: 3721B429B0967262FA14AB2295063BAE791BF46BC4FD84071EE0D07B86DE3CE4069310

Function 00007FF73A5562EC Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A5563E3

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fc9ed733c9531663f2a1fa64f5afa218c335b2449458d7cf86e62dd5dbc485b9
Instruction ID: 65f06460e9ea05f2db98e4758b88dff70bc5962e3b2a3b68531c1f6f9fe30e07
Opcode Fuzzy Hash: fc9ed733c9531663f2a1fa64f5afa218c335b2449458d7cf86e62dd5dbc485b9
Instruction Fuzzy Hash: F531B26AA0D292A5FB017F55D44337CA650AB42BA0FD601B5E91E437D3CFBCE444A330

Function 00007FFB1C4C1E33 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4D8F13

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: cac34a3e2db862f5deff8efb54bc95442bbe16e73addfeb3b076c2fc8d1ba55f
Instruction ID: cab817b5ab4029ab4e31a5cb9fe025b450873ef106f2a539bcab4318e66d7495
Opcode Fuzzy Hash: cac34a3e2db862f5deff8efb54bc95442bbe16e73addfeb3b076c2fc8d1ba55f
Instruction Fuzzy Hash: FE31CEB2708B8582E7508F65E444BED77A1FB88B98F184036EE8C4B759CF78C1548B41

Function 00007FF73A5569CC Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1c2126216073ca25d245121089a136ff3a7aa371bcd7b64ec763e68947bfc6
Instruction ID: 23e4257d676cfd99be07e1942f69e8f852cc92356bbdf5d7cb09891aa70ad0e3
Opcode Fuzzy Hash: 1c1c2126216073ca25d245121089a136ff3a7aa371bcd7b64ec763e68947bfc6
Instruction Fuzzy Hash: 2021F6A6A0D292A5FB017F15D84233CB6506B41BB0F948274FC2E43BD3CE7CE445A320

Function 00007FF73A550C88 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A550BED

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6a0c664ea0f4c756350c608c231ff57430cf4264c82a4fdbd8aab7f477704700
Instruction ID: 04cf1720dfdc01fe18dae9bd7b570053c188b003959ad2aa01d80b172ba90328
Opcode Fuzzy Hash: 6a0c664ea0f4c756350c608c231ff57430cf4264c82a4fdbd8aab7f477704700
Instruction Fuzzy Hash: DB1181AAA0C65295FE60BF55940227EE3A0BF87B94F9440B1FA4E47697CF3CD400A720

Function 00007FF73A560954 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A560977

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c350cc26a48ec555f8fe80a66dafdb4ca60a247c62ca8753b8880114feebe66c
Instruction ID: 5ea760af1fb378bc1d5b40f2eca42d8db45fd0ae64f1d42ea6977ae5ef8ec864
Opcode Fuzzy Hash: c350cc26a48ec555f8fe80a66dafdb4ca60a247c62ca8753b8880114feebe66c
Instruction Fuzzy Hash: 3B210777608A4197FB60AF18D042379B3A1FB85B94F949234E65E476E9DF3CD8009B10

Function 00007FF73A5542D8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF73A5542F7

Part of subcall function 00007FF73A5543E0: GetModuleHandleExW.KERNEL32 ref: 00007FF73A5543FC
Part of subcall function 00007FF73A5543E0: GetProcAddress.KERNEL32 ref: 00007FF73A554412
Part of subcall function 00007FF73A5543E0: FreeLibrary.KERNEL32 ref: 00007FF73A55442F

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 43a0ca25b5b6844c1e1db732f007f001f54d2ff9bdd56d7814c1d6215129c12c
Instruction ID: 6c8930bbaed1953185ec8f74f219aa9c12db533ee022d70ada7628b4c19d74ef
Opcode Fuzzy Hash: 43a0ca25b5b6844c1e1db732f007f001f54d2ff9bdd56d7814c1d6215129c12c
Instruction Fuzzy Hash: 6F21BE76E157019AFF10AF79E0412EC73B1EB15309FC5443AE60E02AA9DF38C485DBA0

Function 00007FF73A54CC00 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54CC54

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 050f2a8f569f90b9d9de9d5361addb679e72bb7a6764323921c2888df917ddcb
Instruction ID: 0a959f0934207a033f83dba9d71067ba45f7bb827e890b34a3c065ec3012e368
Opcode Fuzzy Hash: 050f2a8f569f90b9d9de9d5361addb679e72bb7a6764323921c2888df917ddcb
Instruction Fuzzy Hash: 0201A565A0876291FA04FB565806079E794BFC7FE0F9886B1DE6C57BD6CE3CD4016320

Function 00007FF73A555A80 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a92c8017b1c3694242cf642bf5e48a42ebde1ff1b4540aa1cd3d890f4142b9
Instruction ID: c6a819b9df13ad9cf4dba54368e34ee5ab9d7d91a4cee8f6b5b5be750d860d39
Opcode Fuzzy Hash: 66a92c8017b1c3694242cf642bf5e48a42ebde1ff1b4540aa1cd3d890f4142b9
Instruction Fuzzy Hash: 591194BA91C646A6FB04BF54D4462BDF760EB81760FD04172E64E466E6CF7CE004D720

Function 00007FF73A54C840 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54C85D

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e6931b6c3aa3e516f0ec126b93670d8baae33747ede93eb3b693a768aeb603a6
Instruction ID: 9d286567a249af7ee118b1fefc97c39a84276e5aafa08c70ac191d59ec499c20
Opcode Fuzzy Hash: e6931b6c3aa3e516f0ec126b93670d8baae33747ede93eb3b693a768aeb603a6
Instruction Fuzzy Hash: 200171AAE0811271FE547A66A45727D93505F87764FB506B0F92B4A2C2DE2CE401A260

Function 00007FFB1C505E90 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C505EC6

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID:
API String ID: 1767461275-0
Opcode ID: 7d3f2d7076407b26e569b929bc1f01f90f104b2e2ab4b967782caf0322badc58
Instruction ID: 0e64f05d0879668ec37fa64ad9e12b087b4220a6e8d1f822f8b16148ca1c9b69
Opcode Fuzzy Hash: 7d3f2d7076407b26e569b929bc1f01f90f104b2e2ab4b967782caf0322badc58
Instruction Fuzzy Hash: 940186F260864186D7A45F39D40D3A967A1EB85BACF640035EE5C477E9DA3DD850CB04

Function 00007FF73A54CCA8 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54CCD5

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d27ab3f074c20aa396e25fcbfc74d5af21bb4413395d19741f8897ba95156ec4
Instruction ID: 1f2982721f31c249cd13f91852460251bc526391866e038d4112cbb2cee5a92f
Opcode Fuzzy Hash: d27ab3f074c20aa396e25fcbfc74d5af21bb4413395d19741f8897ba95156ec4
Instruction Fuzzy Hash: DAF0F025F0CAA251FA10BA5AA80703DE351AFC7BE0FA80070F92D87B87CE2CD8415720

Function 00007FF73A54C8C4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54C8E6

Part of subcall function 00007FF73A54C840: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73A54C85D

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 543a764d24b90672a05431dc1a130dac9a0496b5ba23ca517f68794dfbf99782
Instruction ID: 7b680b880d6d1940b2891c52983452cbb80443fe555979f6ea7c493304730a53
Opcode Fuzzy Hash: 543a764d24b90672a05431dc1a130dac9a0496b5ba23ca517f68794dfbf99782
Instruction Fuzzy Hash: 7EF09A68A0C21271FA54BAA9A417179A3909FC3790FB801B0FA1E86283CE2CE441B330

Function 00007FF73A553048 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73A55306A

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: dccd32863e6f506b4f301f1450c7bfa29d8f33399d9aa950cae963106b31457f
Instruction ID: a488f52968aae4857d2c25da2392a2132dd284ed275de5a023a5958e2272e8a1
Opcode Fuzzy Hash: dccd32863e6f506b4f301f1450c7bfa29d8f33399d9aa950cae963106b31457f
Instruction Fuzzy Hash: A1E0A064A0874260FD04BBA6A422079A2904F82BF0F941770FA3E462D2DE2CD0449320

Function 00007FFB1C4C1C53 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C506A86

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: d33bc3e20174ff662c2684bfcedc2da21113de147c5f64ab05f816e3f22c15e4
Instruction ID: 638be1e53d6ec9053e0403913557cc66762429229249ab4a10c9ccd96376fa07
Opcode Fuzzy Hash: d33bc3e20174ff662c2684bfcedc2da21113de147c5f64ab05f816e3f22c15e4
Instruction Fuzzy Hash: 16E048F6F1550286F7605BB5D44BBA81791DF48728F741030EE0CC6682EA6DE9E28614

Function 00007FF73A546CA0 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73A547490: MultiByteToWideChar.KERNEL32 ref: 00007FF73A5474CA

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF73A542E7E), ref: 00007FF73A546CC3

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 7c69f5bdda1eef16465723f98914207d24655a7f3b6b4d41d5decdc102751653
Instruction ID: 5df4d966be4ace8780a0d5913835b2bba71dd9c90e32aa29fa680273f5754da0
Opcode Fuzzy Hash: 7c69f5bdda1eef16465723f98914207d24655a7f3b6b4d41d5decdc102751653
Instruction Fuzzy Hash: 2AE02612B1415262EA18A777A50207AE3519F49FC0B9890309E4E43715CC3CC4804A00

Function 00007FF73A559550 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF73A5586BD,?,?,00000000,00007FF73A54FC79,?,?,?,?,00007FF73A5559F1), ref: 00007FF73A5595A5

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: afbdb11ed1b08d377bc5fadb4004119812ee57a7d3acb3d5a3c71706b847d8e8
Instruction ID: d5b25505d0ca7775d12c404514996402563585c51e4e1458ad5688ce35873623
Opcode Fuzzy Hash: afbdb11ed1b08d377bc5fadb4004119812ee57a7d3acb3d5a3c71706b847d8e8
Instruction Fuzzy Hash: D6F0629CB0A203A1FE54775655032B5D2955F67B80FCC00B0ED0F863D2DF1CE494A230

Function 00007FF73A557D90 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF73A557DCE

Memory Dump Source

Source File: 00000002.00000002.1362304826.00007FF73A541000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73A540000, based on PE: true

Associated: 00000002.00000002.1362281116.00007FF73A540000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362337589.00007FF73A565000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A577000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A57A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362366224.00007FF73A586000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1362441515.00007FF73A588000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff73a540000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: da64b355eaac81519204d4bb0c2681d204a24ced9ca617c428c4ac08c8bc7bff
Instruction ID: 838cd11c01d95125691ee08ea9dc08ceda928b396c2aba794236050533427393
Opcode Fuzzy Hash: da64b355eaac81519204d4bb0c2681d204a24ced9ca617c428c4ac08c8bc7bff
Instruction Fuzzy Hash: A1F08299B0D60761FF5477A25843275D2805F47BA0FC80AB0FD2F862D2DE2CA4406A30

Non-executed Functions

Function 00007FFB1C4ECBE0 Relevance: 77.4, APIs: 43, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1(?,?,?,00000000,00000000,00007FFB1C4E73B9), ref: 00007FFB1C4ECC2D
ERR_put_error.LIBCRYPTO-1_1(?,?,?,00000000,00000000,00007FFB1C4E73B9), ref: 00007FFB1C4ECC7C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 131c4f0313213e41302a315b465f8ae423fd657ca5e36f2fdaa761d64634bd4d
Instruction ID: 58720c169e5a671cd5f60f3d7008e4fd81a7463d98ddec5099ae805c969700d3
Opcode Fuzzy Hash: 131c4f0313213e41302a315b465f8ae423fd657ca5e36f2fdaa761d64634bd4d
Instruction Fuzzy Hash: 78E19FE2A0CE4281FA209B35E40A7F967A2EB817B8F614135DA8D077D5DF3CD651C706

Function 00007FFB1C4E78A0 Relevance: 66.7, APIs: 37, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

X509_VERIFY_PARAM_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E78D7

Part of subcall function 00007FFB1C4EC9A0: OPENSSL_sk_pop_free.LIBCRYPTO-1_1(?,00007FFB1C4E7323), ref: 00007FFB1C4EC9C1
Part of subcall function 00007FFB1C4EC9A0: OPENSSL_sk_pop_free.LIBCRYPTO-1_1(?,00007FFB1C4E7323), ref: 00007FFB1C4EC9D7
Part of subcall function 00007FFB1C4EC9A0: X509_free.LIBCRYPTO-1_1(?,00007FFB1C4E7323), ref: 00007FFB1C4EC9E4

CRYPTO_free_ex_data.LIBCRYPTO-1_1 ref: 00007FFB1C4E78F4
BIO_pop.LIBCRYPTO-1_1 ref: 00007FFB1C4E7904
BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7911
BIO_free_all.LIBCRYPTO-1_1 ref: 00007FFB1C4E7922
BIO_free_all.LIBCRYPTO-1_1 ref: 00007FFB1C4E792B
BUF_MEM_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7937
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7943
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E794F
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E795B
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7967
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E79AA
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E79D7
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E79F0
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7A15
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7A2E
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7A47
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7A60
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7A73
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7A86
SCT_LIST_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7A92
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7AAB
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7AC4
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7ADD
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7AF6
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7B1B
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7B34
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7B4D
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7B59
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7B6C
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7B7F
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7B92
ASYNC_WAIT_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7BC5
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7BDE
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7BEA
CRYPTO_THREAD_lock_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7BF6
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E7C0B

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4E799D, 00007FFB1C4E79CA, 00007FFB1C4E79E3, 00007FFB1C4E7A08, 00007FFB1C4E7A21, 00007FFB1C4E7A3A, 00007FFB1C4E7A53, 00007FFB1C4E7A9E, 00007FFB1C4E7AB7, 00007FFB1C4E7AD0, 00007FFB1C4E7AE9, 00007FFB1C4E7B0E, 00007FFB1C4E7B27, 00007FFB1C4E7B40, 00007FFB1C4E7BD1, 00007FFB1C4E7C01

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$L_sk_pop_free$L_sk_free$M_freeO_free_allX_free$D_lock_freeO_free_ex_dataO_popT_freeX509_X509_free
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1751156600-1080266419
Opcode ID: 95752471d6735af5db67e0374db75f03dc697725d5da531668c73244437b2abd
Instruction ID: bdc6065e45745a6c9fdd12703c6f791a0be80c858174606bb9afd9ef00e35505
Opcode Fuzzy Hash: 95752471d6735af5db67e0374db75f03dc697725d5da531668c73244437b2abd
Instruction Fuzzy Hash: CF81FEE5A08E4280EF40EF31D45A7F823A2EF81BA8F645031DE4D4B2AADE2DE545C715

Function 00007FFB1C4DFD40 Relevance: 57.0, APIs: 22, Strings: 10, Instructions: 1017stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB1C4DFDA8
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB1C4DFDCD
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DFE7B
CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4DFF23
CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4E0729
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E0748
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E076A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB1C4E0917
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E09AE
OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FFB1C4E09C0
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E09DF
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4E09F6
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FFB1C4E0A05
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4E0A10
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4E0A22
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4E0A41
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E0A65
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E0A89
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E0ACF
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E0AD7

Strings

ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFB1C4DFEB2, 00007FFB1C4DFEBF
SUITEB128ONLY, xrefs: 00007FFB1C4DFD9F
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFB1C4DFEAB
ALL:!COMPLEMENTOFDEFAULT:!eNULL, xrefs: 00007FFB1C4E093B
SUITEB128, xrefs: 00007FFB1C4DFDE7
DEFAULT, xrefs: 00007FFB1C4E0904
..\s\ssl\ssl_ciph.c, xrefs: 00007FFB1C4DFE5C, 00007FFB1C4DFF18, 00007FFB1C4E0713, 00007FFB1C4E073B, 00007FFB1C4E075A, 00007FFB1C4E09A4, 00007FFB1C4E09D8, 00007FFB1C4E0A58, 00007FFB1C4E0AC8
SUITEB192, xrefs: 00007FFB1C4DFE08
SUITEB128C2, xrefs: 00007FFB1C4DFDC3
ECDHE-ECDSA-AES128-GCM-SHA256, xrefs: 00007FFB1C4DFEC8

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$strncmp$L_sk_freeL_sk_numL_sk_pushO_mallocR_put_error$L_sk_new_nullL_sk_value
String ID: ..\s\ssl\ssl_ciph.c$ALL:!COMPLEMENTOFDEFAULT:!eNULL$DEFAULT$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192
API String ID: 3367745429-3030769715
Opcode ID: 5f73756aac8c2038217794ba8fa27252bb0bf199f6d0dc2c46d8ec2f26614ff2
Instruction ID: 6c17404fe5fcd9e830454e872f03c75748d28a21ccd0eb427aa86c1c2555e4d7
Opcode Fuzzy Hash: 5f73756aac8c2038217794ba8fa27252bb0bf199f6d0dc2c46d8ec2f26614ff2
Instruction Fuzzy Hash: 3C927EF2A0DF4681EA68CE65D0487B863A2FB14B98F298035DE5C47784DF3DDA61D740

Function 00007FFB1C4F4A90 Relevance: 54.5, APIs: 28, Strings: 3, Instructions: 268COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C4C1073: ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E331A

CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FFB1C4F4AD3
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F4AF7
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFB1C4F4B1E
CRYPTO_THREAD_lock_new.LIBCRYPTO-1_1 ref: 00007FFB1C4F4B2A
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F4B52
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4B63
CRYPTO_new_ex_data.LIBCRYPTO-1_1 ref: 00007FFB1C4F4BA7
CRYPTO_THREAD_lock_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4BB7
CRYPTO_THREAD_read_lock.LIBCRYPTO-1_1 ref: 00007FFB1C4F4C96
CRYPTO_THREAD_read_lock.LIBCRYPTO-1_1 ref: 00007FFB1C4F4CA9
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FFB1C4F4CE4
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FFB1C4F4CF0
memset.VCRUNTIME140 ref: 00007FFB1C4F4D05
CRYPTO_free_ex_data.LIBCRYPTO-1_1 ref: 00007FFB1C4F4DEF
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB1C4F4DFD
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB1C4F4E0E
X509_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4E1A
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4E2D
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4E42
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4E57
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4E6C
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4E81
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4E96
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4EAB
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4EC0
CRYPTO_THREAD_lock_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4ECC
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F4EE2
memcpy.VCRUNTIME140 ref: 00007FFB1C4F4F0D

Strings

T, xrefs: 00007FFB1C4F4B3E
..\s\ssl\ssl_sess.c, xrefs: 00007FFB1C4F4AB6
, xrefs: 00007FFB1C4F4C77

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$R_put_error$D_lock_freeD_read_lockD_unlockL_cleanse$D_lock_newL_sk_pop_freeO_clear_freeO_free_ex_dataO_new_ex_dataO_zallocX509_free_time64memcpymemset
String ID: $..\s\ssl\ssl_sess.c$T
API String ID: 1939687532-2024727245
Opcode ID: 9280862a0fb8c8d4285b3af451dfa1a347018f425d8e1cd9583ff88e8d2f59bf
Instruction ID: 49e33350567961f14da86aabe62f812af3538927c957ec3d1cd7b813cc9bfedc
Opcode Fuzzy Hash: 9280862a0fb8c8d4285b3af451dfa1a347018f425d8e1cd9583ff88e8d2f59bf
Instruction Fuzzy Hash: F4C188F2A08A8282EB549F36D4597F927A2EB84BA8F244035DE4D4B795CF3CE561C710

Function 00007FFB1C51DE20 Relevance: 53.2, APIs: 27, Strings: 3, Instructions: 725COMMON

Download Yara Rule

APIs

OPENSSL_sk_free.LIBCRYPTO-1_1(?,?,?,?,?,?,?,?,?,?,?,00007FFB1C51F215), ref: 00007FFB1C51DEC5
OPENSSL_sk_free.LIBCRYPTO-1_1(?,?,?,?,?,?,?,?,?,?,?,00007FFB1C51F215), ref: 00007FFB1C51DECE
CRYPTO_free.LIBCRYPTO-1_1(?,?,?,?,?,?,?,?,?,?,?,00007FFB1C51F215), ref: 00007FFB1C51DEE3
CRYPTO_free.LIBCRYPTO-1_1(?,?,?,?,?,?,?,?,?,?,?,00007FFB1C51F215), ref: 00007FFB1C51DEF8
memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFB1C51F215), ref: 00007FFB1C51E0FF
OPENSSL_sk_num.LIBCRYPTO-1_1(?,?,?,?,?,?,?,?,?,?,?,00007FFB1C51F215), ref: 00007FFB1C51E1CF
OPENSSL_sk_value.LIBCRYPTO-1_1(?,?,?,?,?,?,?,?,?,?,?,00007FFB1C51F215), ref: 00007FFB1C51E1E6
OPENSSL_sk_num.LIBCRYPTO-1_1(?,?,?,?,?,?,?,?,?,?,?,00007FFB1C51F215), ref: 00007FFB1C51E242

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFB1C51DE44, 00007FFB1C51EA92
P, xrefs: 00007FFB1C51DE55
@, xrefs: 00007FFB1C51E4E4

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: L_sk_freeL_sk_numO_free$L_sk_valuememcmp
String ID: ..\s\ssl\statem\statem_srvr.c$@$P
API String ID: 1579232405-1224705267
Opcode ID: 5ff6cfb6c084fe16ffe9fd898613fdf76acc1461f5c285e479f3077341226e64
Instruction ID: 9258348c12fa9cb7d415250fd5c2dad610b22bb9286f76c0d227a30530f4c4cc
Opcode Fuzzy Hash: 5ff6cfb6c084fe16ffe9fd898613fdf76acc1461f5c285e479f3077341226e64
Instruction Fuzzy Hash: 23727AF2A08A82C5EB609F21D46E7F927A2FB44BA8F285135DE4D47795CF78E480D701

Function 00007FFB1C4DC8B0 Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4DC8DC
X509_STORE_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB1C4DC911
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DC939
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FFB1C4DC95F
X509_STORE_CTX_init.LIBCRYPTO-1_1 ref: 00007FFB1C4DC970
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DC994
X509_STORE_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DC99C
X509_STORE_CTX_set_flags.LIBCRYPTO-1_1 ref: 00007FFB1C4DC9D5
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FFB1C4DC9E8
X509_STORE_CTX_set_ex_data.LIBCRYPTO-1_1 ref: 00007FFB1C4DCA0D
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4DCA2D
X509_STORE_CTX_set0_dane.LIBCRYPTO-1_1 ref: 00007FFB1C4DCA3C
X509_STORE_CTX_set_default.LIBCRYPTO-1_1 ref: 00007FFB1C4DCA59
X509_VERIFY_PARAM_set1.LIBCRYPTO-1_1 ref: 00007FFB1C4DCA68
X509_STORE_CTX_set_verify_cb.LIBCRYPTO-1_1 ref: 00007FFB1C4DCA7C
X509_verify_cert.LIBCRYPTO-1_1 ref: 00007FFB1C4DCAA2
X509_STORE_CTX_get_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DCAAC
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DCAC5
X509_STORE_CTX_get0_chain.LIBCRYPTO-1_1 ref: 00007FFB1C4DCAD8
X509_STORE_CTX_get1_chain.LIBCRYPTO-1_1 ref: 00007FFB1C4DCAE5
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DCB11
X509_VERIFY_PARAM_move_peername.LIBCRYPTO-1_1 ref: 00007FFB1C4DCB22
X509_STORE_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DCB2A

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFB1C4DC91E, 00007FFB1C4DC979, 00007FFB1C4DCAF6
ssl_client, xrefs: 00007FFB1C4DCA44
ssl_server, xrefs: 00007FFB1C4DCA4B

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X509_$R_put_error$L_sk_numX_free$D_run_onceL_sk_pop_freeL_sk_valueM_move_peernameM_set1X509_verify_certX_get0_chainX_get1_chainX_get_errorX_initX_newX_set0_daneX_set_defaultX_set_ex_dataX_set_flagsX_set_verify_cb
String ID: ..\s\ssl\ssl_cert.c$ssl_client$ssl_server
API String ID: 4052934069-2466788060
Opcode ID: 170dc6b6fed48754d43af62c909806659f01a73f9851bc843363a92bdca80eb4
Instruction ID: 1eddf4c01ca89531e1eb75d08c50a5d1c4e3c340a7ea0e328687eb98a06ce521
Opcode Fuzzy Hash: 170dc6b6fed48754d43af62c909806659f01a73f9851bc843363a92bdca80eb4
Instruction Fuzzy Hash: 856148E1B0CA4285EA04AF35D95A3FA63A2AF45BE8F644035DE0D87796EF3CE501C705

Function 00007FFB1C4C1DBB Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C7A2
BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C7D2
BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C800
BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C821
BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C842
BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C85F
BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C87F
BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C89F
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FFB1C52C8F9
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FFB1C52C938
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C52C970
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C985
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C99E
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C9A6
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C9AF
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C9BB
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C9C7
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C9D3
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C9DF
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C9E7
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C9F3

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFB1C52C8F2, 00007FFB1C52C931, 00007FFB1C52C95B, 00007FFB1C52C978, 00007FFB1C52C991

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: N_dupN_free$O_freeO_strdup$R_put_error
String ID: ..\s\ssl\tls_srp.c
API String ID: 2900198586-1778748169
Opcode ID: fba1a0e93acdf385889898895f4a091989b9f2d66acd5093f87c50cb35fb8db5
Instruction ID: 7721e120e4e5d1c16bbffcedfff3acca4174fec2103c8f346688ce21fdfd22aa
Opcode Fuzzy Hash: fba1a0e93acdf385889898895f4a091989b9f2d66acd5093f87c50cb35fb8db5
Instruction Fuzzy Hash: F4A128A2E0AF82C1EA48DF60C5163E863E1FB48B54F684136EA8C47356EF68F591C750

Function 00007FFB1C4C1C94 Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 340COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C529B79
HMAC_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C529B81

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFB1C529A1D, 00007FFB1C529A84, 00007FFB1C529AC3, 00007FFB1C529B4C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X_free
String ID: ..\s\ssl\t1_lib.c
API String ID: 2268491255-1643863364
Opcode ID: 39fcb7bf7e754cf3bc8b1664b373b9b3165719ad1a44c3dae43c94a0ce0852d8
Instruction ID: 7b0585535fbc1e21c48ef0123862febab9a08d6202e0e77592744f7a6ec186ff
Opcode Fuzzy Hash: 39fcb7bf7e754cf3bc8b1664b373b9b3165719ad1a44c3dae43c94a0ce0852d8
Instruction Fuzzy Hash: B9D19EE2A0DAC2C6EB649E36D49A3F963E6EB44BE4F640035DE4E47795DE2CE540C700

Function 00007FFB1C519080 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 351COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C519110
EVP_CIPHER_CTX_new.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C519143
CRYPTO_free.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C5191BD
EVP_CIPHER_CTX_free.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C5191C5
HMAC_CTX_free.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C5191CD

Part of subcall function 00007FFB1C4C194C: ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4D933A
Part of subcall function 00007FFB1C4C194C: ASN1_item_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D9349

CRYPTO_free.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C5192F8
EVP_CIPHER_CTX_free.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C519300
HMAC_CTX_free.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C519308
EVP_CIPHER_CTX_iv_length.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C51935A
EVP_CIPHER_iv_length.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C519373
RAND_bytes.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C519381
EVP_sha256.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C5193B9
EVP_EncryptUpdate.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C51948C
EVP_EncryptFinal.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C5194D0
HMAC_Update.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C519546
HMAC_Final.LIBCRYPTO-1_1(?,?,?,?,..\s\ssl\statem\statem_srvr.c,?,?,?,00007FFB1C51CBD7), ref: 00007FFB1C51956F

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFB1C519084, 00007FFB1C5190FD, 00007FFB1C519608

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X_free$EncryptFinalO_freeUpdate$D_bytesN1_item_freeO_mallocP_sha256R_iv_lengthR_put_errorX_iv_lengthX_new
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 4021942034-348624464
Opcode ID: ed84ce99f1aa95547bbb2a12c5082692e39b2f86ca2c9303ca3c864b6656c0ee
Instruction ID: 243084c9f6afadb264b639908e502c5e5c873e4681474c6367091f75004186fc
Opcode Fuzzy Hash: ed84ce99f1aa95547bbb2a12c5082692e39b2f86ca2c9303ca3c864b6656c0ee
Instruction Fuzzy Hash: FFE18EE1B0CA82C5FB209A72D46E2FD27B2AF457A8F241431EE4D57B96DE3CE5058740

Function 00007FFB1C520950 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 398COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FFB1C52097E
d2i_X509.LIBCRYPTO-1_1 ref: 00007FFB1C520B39
X509_free.LIBCRYPTO-1_1 ref: 00007FFB1C520D50
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C520D5F

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFB1C5209A2, 00007FFB1C520ACC, 00007FFB1C521018

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pop_freeX509X509_freed2i_
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 1068509327-348624464
Opcode ID: 7df268dd69960d6dd5b7b77b94bdabd8f1ef993073f8e7e41ab365d91d4bf760
Instruction ID: 9d492089baa91757da049880b9966ceed130987a0ef67bb399dd89677262554c
Opcode Fuzzy Hash: 7df268dd69960d6dd5b7b77b94bdabd8f1ef993073f8e7e41ab365d91d4bf760
Instruction Fuzzy Hash: 1302A1F2A0EA8185E7608F25D4497FA77E3EB84BA8F244135DA8D47A95DF3CE541CB00

Function 00007FFB1C4C1924 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

BN_copy.LIBCRYPTO-1_1 ref: 00007FFB1C52CC59
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52CC6A
BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52CC7B
BN_copy.LIBCRYPTO-1_1 ref: 00007FFB1C52CC9B
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52CCAC
BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52CCBD
BN_copy.LIBCRYPTO-1_1 ref: 00007FFB1C52CCDD
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52CCEE
BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52CCFF
BN_copy.LIBCRYPTO-1_1 ref: 00007FFB1C52CD27
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52CD38
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C52CD75
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FFB1C52CD8A

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFB1C52CD6E, 00007FFB1C52CD80

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: N_copyN_free$N_dup$O_freeO_strdup
String ID: ..\s\ssl\tls_srp.c
API String ID: 3070725730-1778748169
Opcode ID: e6a38270368c6bdd3c5f1a7e08d125fd0d42f465df9cec924c47682fce42bd4e
Instruction ID: 7cd3d247dd9ffba6cc422a6f71e1d625f3306428af60350ac29fad3f3f073eeb
Opcode Fuzzy Hash: e6a38270368c6bdd3c5f1a7e08d125fd0d42f465df9cec924c47682fce42bd4e
Instruction Fuzzy Hash: C8415FE2E0EE82C0FA949FB5D44A3F822D2EF44BA4F284535DD5D0A78ADE6CF4418741

Function 00007FFB1C512FC0 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 334COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_free.LIBCRYPTO-1_1(?,?,?,?,?,?,?,00007FFB1C512D5D), ref: 00007FFB1C51305D
EVP_MD_CTX_free.LIBCRYPTO-1_1(?,?,?,?,?,?,?,00007FFB1C512D5D), ref: 00007FFB1C513066
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C513078
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C51308A
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C51309B
memcpy.VCRUNTIME140 ref: 00007FFB1C5132A6
EVP_CIPHER_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C5132B5
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C5132BE
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C5132D7
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C5132E9
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C5132FA

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FFB1C512FFF, 00007FFB1C5132C7, 00007FFB1C513346, 00007FFB1C5133FB, 00007FFB1C51344E

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$X_free$memcpy
String ID: ..\s\ssl\statem\statem_dtls.c
API String ID: 1711549817-3140652063
Opcode ID: 83b7101e8ac2937d81cdaf3bf1ced28de2a4752b417af06d137fafd6d47e3ccb
Instruction ID: a5ea0ea1cdb8fcde0cb93232150d22a78887d21cc2e1197742bf9338d8b9b1b5
Opcode Fuzzy Hash: 83b7101e8ac2937d81cdaf3bf1ced28de2a4752b417af06d137fafd6d47e3ccb
Instruction Fuzzy Hash: 16F18DE2B08A81C6EB249F71D4693FD37A2FB44B98F245035DA8D47A96CF38D5A4C300

Function 00007FFB1C4D5C70 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C4C1CB7: CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D4294

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D5CA2
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D5CBC
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D5CDC
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D5D03
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D5D23
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D5D43
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D5D56
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D5D69

Part of subcall function 00007FFB1C4C209F: BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D4920
Part of subcall function 00007FFB1C4C209F: EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D4945

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D5D91
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D5DB1
memset.VCRUNTIME140 ref: 00007FFB1C4D5DC5

Part of subcall function 00007FFB1C4C1B2C: BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4EE39A

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D5DF6

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFB1C4D5C8E, 00007FFB1C4D5CC8, 00007FFB1C4D5CE8, 00007FFB1C4D5D0F, 00007FFB1C4D5D2F, 00007FFB1C4D5D7D, 00007FFB1C4D5D9D, 00007FFB1C4D5DE3

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$O_clear_freeY_free$L_sk_pop_freeX_freememset
String ID: ..\s\ssl\s3_lib.c
API String ID: 1684703015-4238427508
Opcode ID: 86dabd167645daf5fbd27ded46d610b722bbc2d5ac5ae6a1c37063d7403dc43a
Instruction ID: 9648f395c8b5089219c088eb7c6889d11614f1b064edc5a9ebf1089041c00bec
Opcode Fuzzy Hash: 86dabd167645daf5fbd27ded46d610b722bbc2d5ac5ae6a1c37063d7403dc43a
Instruction Fuzzy Hash: E1412FE1B04E4394EB40EF76D49A7F82362EBC5B98F285032DD4D4B2A6DE29D146C311

Function 00007FFB1C4C194C Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 270COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4D933A
ASN1_item_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D9349
memcpy.VCRUNTIME140 ref: 00007FFB1C4D9437
memcpy.VCRUNTIME140 ref: 00007FFB1C4D9471
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFB1C4D948D
X509_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D94B5
memcpy.VCRUNTIME140 ref: 00007FFB1C4D94F0
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D957E

Part of subcall function 00007FFB1C4D9E20: CRYPTO_free.LIBCRYPTO-1_1(00000000,00007FFB1C4D951D), ref: 00007FFB1C4D9E4E
Part of subcall function 00007FFB1C4D9E20: CRYPTO_strndup.LIBCRYPTO-1_1(00000000,00007FFB1C4D951D), ref: 00007FFB1C4D9E71

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D963F
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D96A8
ASN1_item_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D96FA

Strings

..\s\ssl\ssl_asn1.c, xrefs: 00007FFB1C4D932A, 00007FFB1C4D93A2, 00007FFB1C4D93CC, 00007FFB1C4D955B, 00007FFB1C4D95D1, 00007FFB1C4D9619, 00007FFB1C4D968E

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$memcpy$N1_item_free$O_strndupR_put_errorX509_free_time64
String ID: ..\s\ssl\ssl_asn1.c
API String ID: 3876440904-3659835543
Opcode ID: 47917725fb4dafc309e5a27ed463685b131ea4e9d910dbb23a76ebe7f37e88ac
Instruction ID: a8a54ce08180657b0b9cdf2b45d53d8cc753eb02907761953165badb95a8aaca
Opcode Fuzzy Hash: 47917725fb4dafc309e5a27ed463685b131ea4e9d910dbb23a76ebe7f37e88ac
Instruction Fuzzy Hash: 7DD14CB6609B8281EB54DF25D4992F833A2FB68B58F684036CE4DC7795DF38E560C300

Function 00007FFB1C4CEC80 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 270COMMON

Download Yara Rule

APIs

EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FFB1C4CED51
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FFB1C4CED59

Strings

..\s\ssl\record\ssl3_record.c, xrefs: 00007FFB1C4CECEC, 00007FFB1C4CED96, 00007FFB1C4CEE14, 00007FFB1C4CF054, 00007FFB1C4CF093, 00007FFB1C4CF0EF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_sizeX_md
String ID: ..\s\ssl\record\ssl3_record.c
API String ID: 3984586431-2721125279
Opcode ID: 855516a419ef9d0c261794be67d6cf8c5c8d5e8523dd669c04a0c131cead8beb
Instruction ID: a067bd807c32d86ea461271edcac23d7ab9694c147d046a9510d571b15f02015
Opcode Fuzzy Hash: 855516a419ef9d0c261794be67d6cf8c5c8d5e8523dd669c04a0c131cead8beb
Instruction Fuzzy Hash: B0C169F2A0CA4285F7608F71E4487ED23A2EF84BA8F640031DA4D4B6A6DF3DE565D714

Function 00007FFB1C4C14B5 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E71EF

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4E71DF, 00007FFB1C4E7361

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: d2bf459168999042e9f57821f4e35d81e82bf3a9ddd04f417fc4b0b3e89cc1cc
Instruction ID: 2d0c4be696edf804bd32121c4a4a8449340fd36920f8558e0c1fb40a9a77cb41
Opcode Fuzzy Hash: d2bf459168999042e9f57821f4e35d81e82bf3a9ddd04f417fc4b0b3e89cc1cc
Instruction Fuzzy Hash: 46D148B2A09F8286EB98DF35D5443E963A2FB44BA8F284035DB4D87785DF38E561C710

Function 00007FFB1C50B510 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

X509_get0_pubkey.LIBCRYPTO-1_1(?,?,?,?,?,?,?,?,?,00007FFB1C50C137), ref: 00007FFB1C50B57F

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50B546, 00007FFB1C50B58F
0, xrefs: 00007FFB1C50B73B

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$0
API String ID: 2698272274-513810425
Opcode ID: 9c54431f1aff23bf55c4e94ef4d25786fad33d056f3126934c3181e624bc991f
Instruction ID: 796f9c04c3e717204c7532284e2dcd54fdbbda4fb0c2dc236cb94fac73c163f7
Opcode Fuzzy Hash: 9c54431f1aff23bf55c4e94ef4d25786fad33d056f3126934c3181e624bc991f
Instruction Fuzzy Hash: 907190F2608A4286F760DF21E4597E96792EF84BA9F144031EE8D87B95DF3CE211CB00

Function 00007FFB1C4C1DCA Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4DD751
CRYPTO_mem_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4DD761
OPENSSL_sk_find.LIBCRYPTO-1_1 ref: 00007FFB1C4DD791
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DD7AA
CRYPTO_mem_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4DD7B4
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DD7D8
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4DD801
CRYPTO_mem_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4DD80F
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DD836
CRYPTO_mem_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4DD840
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DD886

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FFB1C4DD745, 00007FFB1C4DD7A0, 00007FFB1C4DD7B9, 00007FFB1C4DD82C, 00007FFB1C4DD852, 00007FFB1C4DD867

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_mem_ctrl$O_freeR_put_error$L_sk_findL_sk_pushO_malloc
String ID: ..\s\ssl\ssl_ciph.c
API String ID: 951782134-1847046956
Opcode ID: 36ec4bb05a95eb9f3b2332c2b0e55c4628aea11fefe90e87730c7f0b441b28d6
Instruction ID: 61349c2aacbbc28048d69d901052262bd6b903f5f90cf267e6cb0891fad15897
Opcode Fuzzy Hash: 36ec4bb05a95eb9f3b2332c2b0e55c4628aea11fefe90e87730c7f0b441b28d6
Instruction Fuzzy Hash: B14184E4F0CA0282F714AF31E41A7F952A2AF957A8F640135EA4D477C6DF2CE550CB52

Function 00007FFB1C4D74B0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C4C1CB7: CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D4294

EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D74EB
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D7510
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D7542
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D755C
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D757C
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D75A3
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D75C3
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D75E3

Part of subcall function 00007FFB1C4C209F: BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D4920
Part of subcall function 00007FFB1C4C209F: EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D4945

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D760B
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D762B
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D7651

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFB1C4D751C, 00007FFB1C4D7568, 00007FFB1C4D7588, 00007FFB1C4D75AF, 00007FFB1C4D75CF, 00007FFB1C4D75F7, 00007FFB1C4D7617, 00007FFB1C4D763F

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$O_clear_free$Y_free$L_sk_pop_freeX_free
String ID: ..\s\ssl\s3_lib.c
API String ID: 3200038428-4238427508
Opcode ID: f5cbc19f191bdbbaeb835ac490c11a4620ef20affcd928e83707286c609be0f0
Instruction ID: e08aa3390c055ac343108f08c4db4079b798f969d01ab5b1874359ad9844f839
Opcode Fuzzy Hash: f5cbc19f191bdbbaeb835ac490c11a4620ef20affcd928e83707286c609be0f0
Instruction Fuzzy Hash: AE410FE5B05E8394EB40EF65D49A7F82362EB81F98F285032DE4D4B3A6DE2DD146C311

Function 00007FFB1C4C1A87 Relevance: 19.8, APIs: 10, Strings: 1, Instructions: 525COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FFB1C50F16E
memcmp.VCRUNTIME140 ref: 00007FFB1C50F354
EVP_CIPHER_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C50F38B
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C50F3F9
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C50F489
memcmp.VCRUNTIME140 ref: 00007FFB1C50F5BD
memcmp.VCRUNTIME140 ref: 00007FFB1C50F6D6
memcpy.VCRUNTIME140 ref: 00007FFB1C50F770
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C50F99E

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50F103, 00007FFB1C50F3B7, 00007FFB1C50F896

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: memcmp$O_free$X_freememcpy
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 1846924054-1507966698
Opcode ID: 9f9c79774790d019840d3bda7d9c4c1c137c999da376d0c802b04a7703ed0d07
Instruction ID: abf95b63611035a4ae5e11daf8cfec4dd3387c182d336b5920f723b2184fcb85
Opcode Fuzzy Hash: 9f9c79774790d019840d3bda7d9c4c1c137c999da376d0c802b04a7703ed0d07
Instruction Fuzzy Hash: 8A3270F2A08E4285EBA08F21D4597FD27A2FB84BA8F244635DE8D87795DF3CD5918700

Function 00007FFB1C4C1DCF Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 451COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C504162
CRYPTO_strndup.LIBCRYPTO-1_1 ref: 00007FFB1C50417A
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C5041AF
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB1C504244
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFB1C504361

Part of subcall function 00007FFB1C4C16F4: CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4F5648
Part of subcall function 00007FFB1C4C16F4: CRYPTO_THREAD_lock_new.LIBCRYPTO-1_1 ref: 00007FFB1C4F576C
Part of subcall function 00007FFB1C4C16F4: X509_up_ref.LIBCRYPTO-1_1 ref: 00007FFB1C4F57A8
Part of subcall function 00007FFB1C4C16F4: X509_chain_up_ref.LIBCRYPTO-1_1 ref: 00007FFB1C4F57CF
Part of subcall function 00007FFB1C4C16F4: CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FFB1C4F57FD

memcpy.VCRUNTIME140 ref: 00007FFB1C50441F
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB1C5044F4
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB1C50450D

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFB1C504085, 00007FFB1C504249, 00007FFB1C5044E6, 00007FFB1C504766
D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFB1C504159, 00007FFB1C50416D

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: L_cleanse$O_free$D_lock_newO_mallocO_strdupO_strndupX509_chain_up_refX509_up_ref_time64memcpy
String ID: ..\s\ssl\statem\extensions_srvr.c$D:\_w\1\s\ssl\packet_local.h
API String ID: 2801444773-927607112
Opcode ID: 67a78fca7580fbada278ee0b26a26e02ec7b6966a846d2a4d743a98da11c6658
Instruction ID: 6c794e7b6ccc57b96498d2a917072f431980fe709d29c1ecafd1aababd949b1c
Opcode Fuzzy Hash: 67a78fca7580fbada278ee0b26a26e02ec7b6966a846d2a4d743a98da11c6658
Instruction Fuzzy Hash: 9712D4F2A0CA8185E7608F75E4496FD6BA2FB447A8F244035DE8D87695DF7CE560CB00

Function 00007FFB1C4C1B7C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C5B3
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C5CC
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C5D8
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C5E4
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C5F0
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C5FC
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C608
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C614
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C620
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C52C62C

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFB1C52C5A6, 00007FFB1C52C5BF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: N_free$O_free
String ID: ..\s\ssl\tls_srp.c
API String ID: 3506937590-1778748169
Opcode ID: 7a4e086586e7e5950cc742c1465c9dd58449d52353fb3a4a714a90b4b74c669c
Instruction ID: 1843bf156f444d8b13d57d8f235e7b7f9e5f0a80bbc79bf2e2d5feb0a04d7f9e
Opcode Fuzzy Hash: 7a4e086586e7e5950cc742c1465c9dd58449d52353fb3a4a714a90b4b74c669c
Instruction Fuzzy Hash: 24212C92E5CA8281E750EF31C9563F813A1FB98B58F185231ED8C4A257DF68E1C18BD5

Function 00007FFB1C4C1050 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C50B140: OPENSSL_cleanse.LIBCRYPTO-1_1(?,?,00000000,?,?,?,00007FFB1C50C11E), ref: 00007FFB1C50B3D8
Part of subcall function 00007FFB1C50B140: OPENSSL_cleanse.LIBCRYPTO-1_1(?,?,00000000,?,?,?,00007FFB1C50C11E), ref: 00007FFB1C50B3E7
Part of subcall function 00007FFB1C50B140: CRYPTO_clear_free.LIBCRYPTO-1_1(?,?,00000000,?,?,?,00007FFB1C50C11E), ref: 00007FFB1C50B3FB
Part of subcall function 00007FFB1C50B140: CRYPTO_clear_free.LIBCRYPTO-1_1(?,?,00000000,?,?,?,00007FFB1C50C11E), ref: 00007FFB1C50B40F

EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C50C1AA
BN_num_bits.LIBCRYPTO-1_1 ref: 00007FFB1C50C212
BN_bn2bin.LIBCRYPTO-1_1 ref: 00007FFB1C50C254
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C50C25C
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C50C36F
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C50C377
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C50C40C
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C50C4BC
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C50C4FB

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50C0F6

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_clear_free$Y_free$L_cleanseO_free$N_bn2binN_num_bits
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 407376196-1507966698
Opcode ID: a88833a751ba8c54f290278b1c3da83e9ffba360411c6a40eb7dd31f2de895d5
Instruction ID: bc20f071b93639d0296993a3d96cda3749bec87f9976954d019432de886cc8a0
Opcode Fuzzy Hash: a88833a751ba8c54f290278b1c3da83e9ffba360411c6a40eb7dd31f2de895d5
Instruction Fuzzy Hash: EDB190F2608B4281F7A09A22D44A7FD2692EF85BE8F284035DE4D4BB96CF3CE151C705

Function 00007FFB1C4C1C03 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4D86E9
memset.VCRUNTIME140 ref: 00007FFB1C4D8717
memcpy.VCRUNTIME140 ref: 00007FFB1C4D8721
memcpy.VCRUNTIME140 ref: 00007FFB1C4D8753
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D8776
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D87DD
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D87EA
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D8858
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB1C4D885F

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFB1C4D86C5, 00007FFB1C4D875F, 00007FFB1C4D87C6, 00007FFB1C4D8851

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_clear_free$memcpy$L_cleanseO_mallocmemset
String ID: ..\s\ssl\s3_lib.c
API String ID: 2649524955-4238427508
Opcode ID: e10b2675ea391b8c96a63959438fda47d88f974137cbd27b59aada05afaa7c32
Instruction ID: e0239010aab78f26cad105e7b735c87fee1009473111f42dd523c80b6650bcfd
Opcode Fuzzy Hash: e10b2675ea391b8c96a63959438fda47d88f974137cbd27b59aada05afaa7c32
Instruction Fuzzy Hash: 05518CA2B08B8286EB549F26E4496EE67A1FB44FD8F244132EE8D47755CF38D161C740

Function 00007FFB1C4F3A40 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C4C1073: ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E331A

CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FFB1C4F3A7B
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F3AA3

Strings

T, xrefs: 00007FFB1C4F3AF8
..\s\ssl\ssl_sess.c, xrefs: 00007FFB1C4F3A6F, 00007FFB1C4F3A88, 00007FFB1C4F3AF1, 00007FFB1C4F3B43

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error$O_zalloc
String ID: ..\s\ssl\ssl_sess.c$T
API String ID: 1556487804-2647723609
Opcode ID: a86c482ed1667c2386997e7d485d9949709b2799da1d8a0bf24f4547081771c5
Instruction ID: 299e35ab19d70b921ea65cd30dffd256326905c3f200eaa8c19eeb6c2e4fc886
Opcode Fuzzy Hash: a86c482ed1667c2386997e7d485d9949709b2799da1d8a0bf24f4547081771c5
Instruction Fuzzy Hash: E5218CF1A18A4282EB409F71D80A7E927E2EB84B58F984035DA0C47396EF3DE508CB01

Function 00007FFB1C4DDF70 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

COMP_zlib.LIBCRYPTO-1_1 ref: 00007FFB1C4DDF7F
CRYPTO_mem_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4DDF8C
OPENSSL_sk_new.LIBCRYPTO-1_1 ref: 00007FFB1C4DDF98
COMP_get_type.LIBCRYPTO-1_1 ref: 00007FFB1C4DDFA7
CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4DDFD1
COMP_get_name.LIBCRYPTO-1_1 ref: 00007FFB1C4DDFEB
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4DDFFE
OPENSSL_sk_sort.LIBCRYPTO-1_1 ref: 00007FFB1C4DE00A
CRYPTO_mem_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4DE019

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FFB1C4DDFC5

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_mem_ctrl$L_sk_newL_sk_pushL_sk_sortO_mallocP_get_nameP_get_typeP_zlib
String ID: ..\s\ssl\ssl_ciph.c
API String ID: 680475741-1847046956
Opcode ID: fc601f7b2298dc4ad9aa14a32e43defd04effaae636e76015a76306615b03ed8
Instruction ID: d9089c0a5234c5702d6efea0f58345ffba2bad9d96e770e9726d17435f9daa4f
Opcode Fuzzy Hash: fc601f7b2298dc4ad9aa14a32e43defd04effaae636e76015a76306615b03ed8
Instruction Fuzzy Hash: 9E1121E0E0CE0281FA51AF71E45F3F862A7AF557A4F240135E90D4B3D2DE6CE450CA51

Function 00007FFB1C4C1A05 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 381COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FFB1C5212ED
memcpy.VCRUNTIME140 ref: 00007FFB1C5214F0
memcpy.VCRUNTIME140 ref: 00007FFB1C521521
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C52182D
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C52183E

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFB1C521285, 00007FFB1C5212D8

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freememcpy$O_zalloc
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 150470908-348624464
Opcode ID: 25905df1a2fb58a7e17239e788c61e022fc03c988d45c0ab7932db8df7c410e3
Instruction ID: 90226bf7a67277bdb6331f2d6853b584c3dbd695e20701d57e558af9eef2119b
Opcode Fuzzy Hash: 25905df1a2fb58a7e17239e788c61e022fc03c988d45c0ab7932db8df7c410e3
Instruction Fuzzy Hash: E702C2F6A08E41C1EB248F71E4596BF77E2EB44BA4F248135DA8A07A95DF3CE590C700

Function 00007FFB1C50FC00 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

BN_bin2bn.LIBCRYPTO-1_1(?,?,00000000,00000000,?,..\s\ssl\statem\statem_clnt.c,00007FFB1C50DC00), ref: 00007FFB1C50FD9D
BN_bin2bn.LIBCRYPTO-1_1(?,?,00000000,00000000,?,..\s\ssl\statem\statem_clnt.c,00007FFB1C50DC00), ref: 00007FFB1C50FDB1
BN_free.LIBCRYPTO-1_1(?,?,00000000,00000000,?,..\s\ssl\statem\statem_clnt.c,00007FFB1C50DC00), ref: 00007FFB1C50FF6E
BN_free.LIBCRYPTO-1_1(?,?,00000000,00000000,?,..\s\ssl\statem\statem_clnt.c,00007FFB1C50DC00), ref: 00007FFB1C50FF76
BN_free.LIBCRYPTO-1_1(?,?,00000000,00000000,?,..\s\ssl\statem\statem_clnt.c,00007FFB1C50DC00), ref: 00007FFB1C50FF7E
DH_free.LIBCRYPTO-1_1(?,?,00000000,00000000,?,..\s\ssl\statem\statem_clnt.c,00007FFB1C50DC00), ref: 00007FFB1C50FF86
EVP_PKEY_free.LIBCRYPTO-1_1(?,?,00000000,00000000,?,..\s\ssl\statem\statem_clnt.c,00007FFB1C50DC00), ref: 00007FFB1C50FF8E

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50FC05, 00007FFB1C50FF57, 00007FFB1C50FFA7

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: N_free$N_bin2bn$H_freeY_free
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 2982095754-1507966698
Opcode ID: 3a5a9313aeecd8701b66303c6b4f2f749c9303e5e802f2383e71d9512a3d1051
Instruction ID: e78cc1c6de47b20298126b90b19e2aa8e1f3ac05947a737ed659d90252507a07
Opcode Fuzzy Hash: 3a5a9313aeecd8701b66303c6b4f2f749c9303e5e802f2383e71d9512a3d1051
Instruction Fuzzy Hash: A191C9E2A1CAC186E7609B35E4167EE6392FB86794F244130EE8D57B46DF3CE5A1C700

Function 00007FFB1C50AD00 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 198COMMON

Download Yara Rule

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50AD06, 00007FFB1C50AD69, 00007FFB1C50ADA2
, xrefs: 00007FFB1C50AF29

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID:
String ID: $..\s\ssl\statem\statem_clnt.c
API String ID: 0-745226041
Opcode ID: e3065efaf17af3665615d77f752430117421f2a0ef3093e0d7d704072f392376
Instruction ID: de5eb654a51e9013e9b19a1fe2155a2fc4e7a38aaf1b31cd88a4558659b66e40
Opcode Fuzzy Hash: e3065efaf17af3665615d77f752430117421f2a0ef3093e0d7d704072f392376
Instruction Fuzzy Hash: 8F8182F1708B4286FBA49B32D45A7EA2392EF85BA4F204131ED4D8B786DF2CE511D705

Function 00007FFB1C4C1997 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_cipher.LIBCRYPTO-1_1 ref: 00007FFB1C4CFD59
EVP_CIPHER_CTX_block_size.LIBCRYPTO-1_1 ref: 00007FFB1C4CFD84
memset.VCRUNTIME140 ref: 00007FFB1C4CFDB7
EVP_Cipher.LIBCRYPTO-1_1 ref: 00007FFB1C4CFDFE
EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FFB1C4CFE0F
EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FFB1C4CFE20
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FFB1C4CFE28
memcpy.VCRUNTIME140 ref: 00007FFB1C4CFF12

Strings

..\s\ssl\record\ssl3_record.c, xrefs: 00007FFB1C4CFE3E

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X_md$CipherD_sizeX_block_sizeX_ciphermemcpymemset
String ID: ..\s\ssl\record\ssl3_record.c
API String ID: 2016125691-2721125279
Opcode ID: 502e589f068704251ff0e01a6794705a744c4a1ddc9a1bd00fb49a7e75d389f0
Instruction ID: 3d739e606dc4401a63432b435ebc6eaa3cd437ba1feda026685130c4c527f175
Opcode Fuzzy Hash: 502e589f068704251ff0e01a6794705a744c4a1ddc9a1bd00fb49a7e75d389f0
Instruction Fuzzy Hash: 4651B5E2B0CA8182FB249A62D5596FD6792FF45BA8F244036DE0D47B66DF3CE461C304

Function 00007FFB1C4C19EC Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C50D152
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C50D183
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C50D33B
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FFB1C50D366

Strings

D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFB1C50D322, 00007FFB1C50D359
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50D07F, 00007FFB1C50D415, 00007FFB1C50D437, 00007FFB1C50D45B, 00007FFB1C50D4EF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$O_memdup
String ID: ..\s\ssl\statem\statem_clnt.c$D:\_w\1\s\ssl\packet_local.h
API String ID: 3545228654-3043411186
Opcode ID: d1b15e8caddc6c7d546daf75fe7d191105dc789ce5e047a771a82e8e1da3bb25
Instruction ID: 1e2b9a4659fdda8a89018cc56371b3e67d2ed96eb44fc870ec01e3001af93e2a
Opcode Fuzzy Hash: d1b15e8caddc6c7d546daf75fe7d191105dc789ce5e047a771a82e8e1da3bb25
Instruction Fuzzy Hash: 95D1BCF2A18B8185EB50CF25D8496ED37A6EB48BA8F244131EE8C87795DF7CE191C701

Function 00007FFB1C4C1FFF Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFB1C4F51D7
CRYPTO_THREAD_read_lock.LIBCRYPTO-1_1 ref: 00007FFB1C4F51EB
OPENSSL_LH_retrieve.LIBCRYPTO-1_1 ref: 00007FFB1C4F5200
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FFB1C4F5226
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FFB1C4F523E
memcmp.VCRUNTIME140 ref: 00007FFB1C4F5312
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFB1C4F5364

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFB1C4F533E, 00007FFB1C4F545C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_unlock$D_read_lockH_retrieve_time64memcmpmemcpy
String ID: ..\s\ssl\ssl_sess.c
API String ID: 2285684992-2868363209
Opcode ID: 2d240991ae20b9b267ae94038bade2d4c3c07fcccfba24a9a80c9932b1de0c80
Instruction ID: 2ff304d856bda97f8e4bd8092eeaa641034311ec1f9d55093e05d83cc61276c1
Opcode Fuzzy Hash: 2d240991ae20b9b267ae94038bade2d4c3c07fcccfba24a9a80c9932b1de0c80
Instruction Fuzzy Hash: 93C1AEB2A0DA8186E7608F29D4487E933A2FB84BACF240135DE8D47795DF7DE451CB40

Function 00007FFB1C4C9E50 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4C9EB0
memset.VCRUNTIME140 ref: 00007FFB1C4C9F74
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C9F92
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C9FA3

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFB1C4C9EA2

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$O_mallocmemset
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 1168073369-1306860146
Opcode ID: ec0865690f727defc835c1de5643b96a9ad3d4720dc63e568549472fe8a4a053
Instruction ID: a24b7494144bb00cd230db65a1c0853368357634e8577f2d22c3992d76e2d6c2
Opcode Fuzzy Hash: ec0865690f727defc835c1de5643b96a9ad3d4720dc63e568549472fe8a4a053
Instruction Fuzzy Hash: E851AFA2A0CA8181E7109F35E4552F9A3A2FF95BD8F248235EE9D07797DF3DE1918300

Function 00007FFB1C4C192E Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C9405
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C941B
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C9465
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C947B
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C94C5
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C94DB
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C956F

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFB1C4C93F4, 00007FFB1C4C940E, 00007FFB1C4C9454, 00007FFB1C4C946E, 00007FFB1C4C94B4, 00007FFB1C4C94CE, 00007FFB1C4C9562

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 2581946324-1306860146
Opcode ID: 2a3f60c31c6288e67cf18b25ff04af47883c0516c118a50d2f337cdc6253a21d
Instruction ID: e7123cfbb6295fb254e290819b544906ee6ccfb40d7979d0854da548a2073213
Opcode Fuzzy Hash: 2a3f60c31c6288e67cf18b25ff04af47883c0516c118a50d2f337cdc6253a21d
Instruction Fuzzy Hash: 4F514CE6A08F8281EB14DB26D5552F96362FF85BE8F245131DE0D477A6EF2CE451C304

Function 00007FFB1C4DDE80 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CRYPTO_mem_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4DDE9C
OPENSSL_sk_new.LIBCRYPTO-1_1 ref: 00007FFB1C4DDEA8
COMP_get_type.LIBCRYPTO-1_1 ref: 00007FFB1C4DDEB7
CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4DDEE1
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4DDF0E
OPENSSL_sk_sort.LIBCRYPTO-1_1 ref: 00007FFB1C4DDF1A
CRYPTO_mem_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4DDF29

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FFB1C4DDED5

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_mem_ctrl$L_sk_newL_sk_pushL_sk_sortO_mallocP_get_type
String ID: ..\s\ssl\ssl_ciph.c
API String ID: 2525466407-1847046956
Opcode ID: b05dfb50b88ac9030d51cc2a99a7575e16259f66d8a888b634764e14881f3250
Instruction ID: 25d332855f9c417c56fe86d236d61a75faed0843b65a361c99a5126cc5940e7f
Opcode Fuzzy Hash: b05dfb50b88ac9030d51cc2a99a7575e16259f66d8a888b634764e14881f3250
Instruction Fuzzy Hash: F01118E0E0CE0281FA40AF71E86F3F86296AF597A4F240135E94D8B3D2DE6CE410C652

Function 00007FFB1C4C2004 Relevance: 13.6, APIs: 9, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFB1C52F540
memset.VCRUNTIME140 ref: 00007FFB1C52F564
RtlCaptureContext.KERNEL32 ref: 00007FFB1C52F56D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFB1C52F587
RtlVirtualUnwind.KERNEL32 ref: 00007FFB1C52F5C8
memset.VCRUNTIME140 ref: 00007FFB1C52F5FB
IsDebuggerPresent.KERNEL32 ref: 00007FFB1C52F61C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFB1C52F63D
UnhandledExceptionFilter.KERNEL32 ref: 00007FFB1C52F648

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: a3bd725fa3f6e3d1987b393e98cce054d010c51c48ea9264ca440beadc764d39
Instruction ID: 09425a53151dbd033dce8bed6e73205a53ea7137ac79140df84bd7024973f9e1
Opcode Fuzzy Hash: a3bd725fa3f6e3d1987b393e98cce054d010c51c48ea9264ca440beadc764d39
Instruction Fuzzy Hash: E8316DB2619E91CAEB608F70E8453ED73A1FB84764F50453ADA8E47A99DF3CD648C700

Function 00007FFB1C4F8A60 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 301COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FFB1C4F8AEC
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F8F2B

Strings

gfffffff, xrefs: 00007FFB1C4F8CB5
gfffffff, xrefs: 00007FFB1C4F8D9A
gfffffff, xrefs: 00007FFB1C4F8B4E
gfffffff, xrefs: 00007FFB1C4F8C8A
..\s\ssl\statem\extensions.c, xrefs: 00007FFB1C4F8ACF, 00007FFB1C4F8E10, 00007FFB1C4F8E40, 00007FFB1C4F8E70, 00007FFB1C4F8F18

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_zalloc
String ID: ..\s\ssl\statem\extensions.c$gfffffff$gfffffff$gfffffff$gfffffff
API String ID: 2237658545-598456477
Opcode ID: 26c2a54cc7bee07aa243a1484d55d3963bbd58a98d7ddc3f0dff0a11b656c4e2
Instruction ID: 699e71d37c65b87a02af5dbf432dab41ea576205cadfdbd87bd18eb9b1648aff
Opcode Fuzzy Hash: 26c2a54cc7bee07aa243a1484d55d3963bbd58a98d7ddc3f0dff0a11b656c4e2
Instruction Fuzzy Hash: 18C1B5F2B0CA9145FB618B2AE4487E96762FB96B98F644131DE8C4BB84CF3DD461C701

Function 00007FFB1C511D00 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_free.LIBCRYPTO-1_1(?,00000000,?,?,?,00007FFB1C5119DD), ref: 00007FFB1C511E8A
EVP_MD_CTX_free.LIBCRYPTO-1_1(?,00000000,?,?,?,00007FFB1C5119DD), ref: 00007FFB1C511E93
CRYPTO_free.LIBCRYPTO-1_1(?,00000000,?,?,?,00007FFB1C5119DD), ref: 00007FFB1C511EA8
CRYPTO_free.LIBCRYPTO-1_1(?,00000000,?,?,?,00007FFB1C5119DD), ref: 00007FFB1C511EBE
CRYPTO_free.LIBCRYPTO-1_1(?,00000000,?,?,?,00007FFB1C5119DD), ref: 00007FFB1C511ED3

Part of subcall function 00007FFB1C511590: CRYPTO_malloc.LIBCRYPTO-1_1(?,00007FFB1C510918), ref: 00007FFB1C5115CB
Part of subcall function 00007FFB1C511590: ERR_put_error.LIBCRYPTO-1_1(?,00007FFB1C510918), ref: 00007FFB1C5115F3

CRYPTO_free.LIBCRYPTO-1_1(?,00000000,?,?,?,00007FFB1C5119DD), ref: 00007FFB1C51206D

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FFB1C511E9B, 00007FFB1C511EB1, 00007FFB1C511EC9, 00007FFB1C512063

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$X_free$O_mallocR_put_error
String ID: ..\s\ssl\statem\statem_dtls.c
API String ID: 4216106018-3140652063
Opcode ID: 9a6173c6f6360caec21d8dd89abe43646fc57d0e93b76b862ad6f732851a6780
Instruction ID: 6bfd8fde260d81e1e1727e0052d88af757483d7aaabfb290d86a1970534c40cb
Opcode Fuzzy Hash: 9a6173c6f6360caec21d8dd89abe43646fc57d0e93b76b862ad6f732851a6780
Instruction Fuzzy Hash: 4AB1D1F2A08E85C2DB20CF65D45A2BA77A2FB45B94F145231DA8D43B96EF3DE544C300

Function 00007FFB1C4C1BDB Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 235COMMON

Download Yara Rule

APIs

EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FFB1C51C895
RAND_bytes.LIBCRYPTO-1_1 ref: 00007FFB1C51C94F
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFB1C51CA20
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C51CA62
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FFB1C51CA85

Strings

resumption, xrefs: 00007FFB1C51C977
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFB1C51C845, 00007FFB1C51C8A6

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_bytesD_sizeO_freeO_memdup_time64
String ID: ..\s\ssl\statem\statem_srvr.c$resumption
API String ID: 2587329016-332775882
Opcode ID: f8b08ac99c0fcf68b3004e8cde072c051c939498b26e5e23d9909cd90358872d
Instruction ID: 3c4e423cf24ec60b2a3955748900c333e2a62bf1f80faad8289d7fed56e81f8b
Opcode Fuzzy Hash: f8b08ac99c0fcf68b3004e8cde072c051c939498b26e5e23d9909cd90358872d
Instruction Fuzzy Hash: 07B18FA2608F8181EB50CB65D89D7ED67A1EB84BA8F281035DE8C8B795CF7DE545C700

Function 00007FFB1C4C1FF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFB1C4EDE1E, 00007FFB1C4EDE51
..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4EDC3A

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID:
String ID: ..\s\ssl\ssl_lib.c$D:\_w\1\s\ssl\packet_local.h
API String ID: 0-4268535660
Opcode ID: b57257200ac6b5943741a6e2a06c4151246ea5f2c715739b23c0b8cdadcc1fd3
Instruction ID: c0742c6d1f24fa04f7dbe86e69eea1f8aeb9e46cbf2bc6882994802bb0dac493
Opcode Fuzzy Hash: b57257200ac6b5943741a6e2a06c4151246ea5f2c715739b23c0b8cdadcc1fd3
Instruction Fuzzy Hash: CC619EB2708F8185EB60CB29D4486EA77A2EB85BA8F294135DECD0BB95DF3CD151C701

Function 00007FFB1C4C201D Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

..\s\ssl\t1_enc.c, xrefs: 00007FFB1C523677, 00007FFB1C523734
, xrefs: 00007FFB1C5237F4
key expansion, xrefs: 00007FFB1C523802
, xrefs: 00007FFB1C523809

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID:
String ID: $ $..\s\ssl\t1_enc.c$key expansion
API String ID: 0-2405982772
Opcode ID: 3af7c918ad1b542cd47b9d4738d35b8724687ade0d6d22b7d8362e7f2fd14883
Instruction ID: fe548be71def6bf39c8595576ed2a1f6d0ff12deabfeb41b54aa1ddab48fceac
Opcode Fuzzy Hash: 3af7c918ad1b542cd47b9d4738d35b8724687ade0d6d22b7d8362e7f2fd14883
Instruction Fuzzy Hash: CC717BB2609B81C6E7A48F15E4843E9B7A5FB84BA4F144136DB8C47B55DF38D0A9CB00

Function 00007FFB1C51FF20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 133COMMON

Download Yara Rule

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFB1C51FFC1, 00007FFB1C51FFE3, 00007FFB1C520049, 00007FFB1C52007D, 00007FFB1C520184
D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFB1C520001, 00007FFB1C520020

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem_srvr.c$D:\_w\1\s\ssl\packet_local.h
API String ID: 0-119891211
Opcode ID: 8cecd45b7348664260dcb281c15bc716006903721e779956ea84d8cbdb0e7580
Instruction ID: be18874655737c72386a2fceef1e9c700437d35c715f14f90aa8bd67c1c50ab2
Opcode Fuzzy Hash: 8cecd45b7348664260dcb281c15bc716006903721e779956ea84d8cbdb0e7580
Instruction Fuzzy Hash: 8851B1F2B09A81C6F7608B20D84A7E977A2FB84BD8F644131DA8D17A95DF3CE595C700

Function 00007FFB1C4FF920 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1(?,?,?,00007FFB1C4FF4DE), ref: 00007FFB1C4FF95D
CRYPTO_malloc.LIBCRYPTO-1_1(?,?,?,00007FFB1C4FF4DE), ref: 00007FFB1C4FF977
CRYPTO_free.LIBCRYPTO-1_1(?,?,?,00007FFB1C4FF4DE), ref: 00007FFB1C4FFA20
CRYPTO_free.LIBCRYPTO-1_1(?,?,?,00007FFB1C4FF4DE), ref: 00007FFB1C4FFA35
CRYPTO_free.LIBCRYPTO-1_1(?,?,?,00007FFB1C4FF4DE), ref: 00007FFB1C4FFA4E
CRYPTO_free.LIBCRYPTO-1_1(?,?,?,00007FFB1C4FF4DE), ref: 00007FFB1C4FFA63

Strings

..\s\ssl\statem\extensions_cust.c, xrefs: 00007FFB1C4FF94A, 00007FFB1C4FF968, 00007FFB1C4FFA16, 00007FFB1C4FFA2B, 00007FFB1C4FFA44, 00007FFB1C4FFA59

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$O_malloc
String ID: ..\s\ssl\statem\extensions_cust.c
API String ID: 2767441526-3973221358
Opcode ID: c63070249dc08319a323d6044a383dc1e072af8727bd8d953493b5a516d4f782
Instruction ID: 1a0f7cbf59469a4b5c96aafbfcbd74bafc23697fe431c7552e99d19a9d096140
Opcode Fuzzy Hash: c63070249dc08319a323d6044a383dc1e072af8727bd8d953493b5a516d4f782
Instruction Fuzzy Hash: D2316DB5B08F4192EA209B25F8452E973A2FB89BA0F644035EE8C47B95EF3DD151CB40

Function 00007FFB1C4DC070 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FFB1C4DC08F
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DC0B7
CRYPTO_THREAD_lock_new.LIBCRYPTO-1_1 ref: 00007FFB1C4DC0F8
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DC124
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DC139

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFB1C4DC088, 00007FFB1C4DC09C, 00007FFB1C4DC109, 00007FFB1C4DC12F
B, xrefs: 00007FFB1C4DC110

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error$D_lock_newO_freeO_zalloc
String ID: ..\s\ssl\ssl_cert.c$B
API String ID: 3411496311-1824687510
Opcode ID: 156e31d2e0089f871b2b67b52c0dc13743ea0abae28917ddc80827931171c0d4
Instruction ID: 5ae20eaec57307bd8d280364cd4f8c1a1c0df5de6185b96f8a70413dea9d7519
Opcode Fuzzy Hash: 156e31d2e0089f871b2b67b52c0dc13743ea0abae28917ddc80827931171c0d4
Instruction Fuzzy Hash: 6B11BEF5A09A4282FB019F70D40A3E833A2EB40728F540034DA4C47392EF7DE285C715

Function 00007FFB1C4C1A4B Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 303COMMON

Download Yara Rule

APIs

OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB1C4FAF75
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4FAFBA
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FFB1C4FAFD2
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB1C4FB02D
CRYPTO_memcmp.LIBCRYPTO-1_1 ref: 00007FFB1C4FB18E

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFB1C4FADEB, 00007FFB1C4FAF93, 00007FFB1C4FB008

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: L_cleanse$O_freeO_memcmpO_memdup
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 2249876211-592572767
Opcode ID: e4fa8d43ac8dbd0a41f6539ddfb0eff751ef73e13cf1ed7563a11fdb6b503f12
Instruction ID: 9fc57abb7787ce5a3bce0f40d15ed8abd7cf5f45a5001640e7145f246f66ad30
Opcode Fuzzy Hash: e4fa8d43ac8dbd0a41f6539ddfb0eff751ef73e13cf1ed7563a11fdb6b503f12
Instruction Fuzzy Hash: C7D18FE2A0CA8285E7608B25E4483FE67A6FB857ACF240135EE8D47B95DF3CD551C710

Function 00007FFB1C4C14FB Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

EVP_PKEY_get1_tls_encodedpoint.LIBCRYPTO-1_1 ref: 00007FFB1C501C96
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C501CCC
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C501D0B
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C501D6E
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C501D81

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFB1C501B6E, 00007FFB1C501C4E, 00007FFB1C501CA0, 00007FFB1C501CFE, 00007FFB1C501D4D

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeY_free$Y_get1_tls_encodedpoint
String ID: ..\s\ssl\statem\extensions_srvr.c
API String ID: 3595761781-1853348325
Opcode ID: 8f03521a82e318a1da133556698b8a188dc57753de70ec60cda726a384a9a33d
Instruction ID: cfa9fc06ee7f1e13698a763bc979555b0679db9d5fd0bdd0dec2d9eeb7333b6c
Opcode Fuzzy Hash: 8f03521a82e318a1da133556698b8a188dc57753de70ec60cda726a384a9a33d
Instruction Fuzzy Hash: 297193E170CA0285F7609B62E54A2FA7392EF85BE4F240030EE4D87BA6DF2CE5158705

Function 00007FFB1C511900 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C511590: CRYPTO_malloc.LIBCRYPTO-1_1(?,00007FFB1C510918), ref: 00007FFB1C5115CB
Part of subcall function 00007FFB1C511590: ERR_put_error.LIBCRYPTO-1_1(?,00007FFB1C510918), ref: 00007FFB1C5115F3

EVP_CIPHER_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C511AB8
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C511AC1
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C511AD7
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C511AED
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C511B02

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FFB1C511ACA, 00007FFB1C511AE0, 00007FFB1C511AF8

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$X_free$O_mallocR_put_error
String ID: ..\s\ssl\statem\statem_dtls.c
API String ID: 4216106018-3140652063
Opcode ID: 2c4d853c6100f92bbf393405b16090aad74d407352ff447b557f66cd55866843
Instruction ID: d62a915fbbaefe006e082f96dc642ebeb55bd848777e1d5ce85a652a1a00d730
Opcode Fuzzy Hash: 2c4d853c6100f92bbf393405b16090aad74d407352ff447b557f66cd55866843
Instruction Fuzzy Hash: E26181A2A08E81C2EB648F75D45A2FA77A2FB84794F245131DB8D47A55EF3CE590C700

Function 00007FFB1C4C1FCD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C5289D9
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C528A01

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFB1C5289BD, 00007FFB1C5289E6, 00007FFB1C528A65, 00007FFB1C528A99

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_mallocR_put_error
String ID: ..\s\ssl\t1_lib.c
API String ID: 2513334388-1643863364
Opcode ID: 70ce4452ff554ce92aa7dc466e929df143ae259871583eca671b582b7033c19d
Instruction ID: b63bf492f0364ba36bd1bf9fa1d05c1628f8c1bb22ac7b41650bde4f69ce90b0
Opcode Fuzzy Hash: 70ce4452ff554ce92aa7dc466e929df143ae259871583eca671b582b7033c19d
Instruction Fuzzy Hash: AD3192F2B09A42C5EB648F75E40A6E9A7A2EF447B0F684035EA8D43785EF3CE541C700

Function 00007FFB1C4DCCB0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

i2d_X509_NAME.LIBCRYPTO-1_1 ref: 00007FFB1C4DCCD7
i2d_X509_NAME.LIBCRYPTO-1_1 ref: 00007FFB1C4DCCE7
memcmp.VCRUNTIME140 ref: 00007FFB1C4DCD0C
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DCD2A
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DCD41

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFB1C4DCD20, 00007FFB1C4DCD34

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeX509_i2d_$memcmp
String ID: ..\s\ssl\ssl_cert.c
API String ID: 1487052844-349359282
Opcode ID: a85c698992f953c702283c22d9355ccb1e424539bb9a02a3fd06e6b063fa9208
Instruction ID: 5d437643a6ef5f42cff537095634fe38b6fb8b9a4837e14f7710d8db07f8309e
Opcode Fuzzy Hash: a85c698992f953c702283c22d9355ccb1e424539bb9a02a3fd06e6b063fa9208
Instruction Fuzzy Hash: 5001A5E2B0CE0281EA10AE39F8592F957A39F857E0F345131EA4D877C9DE3DD5408700

Function 00007FFB1C4C6BA0 Relevance: 9.1, APIs: 6, Instructions: 92COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4C6BD9
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4C6C1F
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4C6C6B
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4C6C96
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4C6CC7
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4C6CFF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: 74b11129380cdb8a250839d01df6d440ae63addc88e66dc5812c7c46ed7e9f2b
Instruction ID: 27f1548e99f090bc150a9e3a9a027598f2cc82951692c4bb0eeb6349c791c519
Opcode Fuzzy Hash: 74b11129380cdb8a250839d01df6d440ae63addc88e66dc5812c7c46ed7e9f2b
Instruction Fuzzy Hash: 633183B2728B8182DB98AF75D595BFD2292EF88B94F144034DE4D47752DF6CA4208705

Function 00007FFB1C4C205E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

EVP_PKEY_get1_tls_encodedpoint.LIBCRYPTO-1_1 ref: 00007FFB1C4FB7E3
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4FB862
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C4FB8EC
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4FB8FF

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFB1C4FB726, 00007FFB1C4FB78D, 00007FFB1C4FB853, 00007FFB1C4FB8B9, 00007FFB1C4FB916

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$Y_freeY_get1_tls_encodedpoint
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 4042585043-592572767
Opcode ID: 196fba9c7cd42ba4acc4e8fa981f07e458ffb2ac020c6218ad46c2686c75af8a
Instruction ID: 5785dc7ce16c22c393258c79e77cf96d268bfb4f483c75d7261d70a78fc32f4f
Opcode Fuzzy Hash: 196fba9c7cd42ba4acc4e8fa981f07e458ffb2ac020c6218ad46c2686c75af8a
Instruction Fuzzy Hash: F77192F1B0CA4186E7609B25E4487FA67A2FF85BA8F284031EE4D47B95DF3CD9618704

Function 00007FFB1C4C1F32 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C51C52F
CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C51C54D
RAND_bytes.LIBCRYPTO-1_1 ref: 00007FFB1C51C57B

Strings

, xrefs: 00007FFB1C51C53A
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFB1C51C51F, 00007FFB1C51C6FD

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_bytesO_freeO_malloc
String ID: $..\s\ssl\statem\statem_srvr.c
API String ID: 693915670-1632442243
Opcode ID: 72ccb6d8a8070cfbe13bc66c77cd6ce08e53d3fda3aa45b65086780b5493f192
Instruction ID: 98330412761d93757128d61677a99819fded28e2736acd4b651519595e1e2e09
Opcode Fuzzy Hash: 72ccb6d8a8070cfbe13bc66c77cd6ce08e53d3fda3aa45b65086780b5493f192
Instruction Fuzzy Hash: 255180E1A0CA4281FB609A36D52E3F96696AF81BE8F382031DD4D4B7D6DF6DF4418704

Function 00007FFB1C4C1983 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C51EE90
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FFB1C51EEA8
memcmp.VCRUNTIME140 ref: 00007FFB1C51EF47
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FFB1C51EF91

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFB1C51EE79, 00007FFB1C51EFE1

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_memdup$O_freememcmp
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 590648765-348624464
Opcode ID: 7276538f9ac6b0b5ece5a277f7a0461afb4d3f23f411ab5e9bc9cc9926141857
Instruction ID: d5bce0455c35459d5c5f591f208b1c370e87b81c597e3d3f52a935f7760f8859
Opcode Fuzzy Hash: 7276538f9ac6b0b5ece5a277f7a0461afb4d3f23f411ab5e9bc9cc9926141857
Instruction Fuzzy Hash: 7F517CF2608AC181E7508F25E4AD6AD67E1FB84BA4F284135EE8D4B794CF7CD285DB10

Function 00007FFB1C4ECA20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4ECA66
CRYPTO_realloc.LIBCRYPTO-1_1 ref: 00007FFB1C4ECAB5
CRYPTO_realloc.LIBCRYPTO-1_1 ref: 00007FFB1C4ECAE3
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4ECB0D

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4ECA4B, 00007FFB1C4ECAAE, 00007FFB1C4ECAD0, 00007FFB1C4ECAFD

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_reallocR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1389097454-1080266419
Opcode ID: 0e0c00c90325760c589c662fc650738864e9bd0882f728e83c2b1810c7a60c92
Instruction ID: 79ddb47b0aa6b0b0f980973a8b667fd2eee01c1435ddcb25a4a92c2ffe5ac0af
Opcode Fuzzy Hash: 0e0c00c90325760c589c662fc650738864e9bd0882f728e83c2b1810c7a60c92
Instruction Fuzzy Hash: AE31DFF2608B8286EB119F35E8046E9B7A2FB45BA8F654131DE8D07794DF3CD652C704

Function 00007FFB1C4DFAF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-1_1(?,?,?,00007FFB1C4DF8E2), ref: 00007FFB1C4DFB57
ERR_put_error.LIBCRYPTO-1_1(?,?,?,00007FFB1C4DF8E2), ref: 00007FFB1C4DFB7F
CRYPTO_free.LIBCRYPTO-1_1(?,?,?,00007FFB1C4DF8E2), ref: 00007FFB1C4DFC67

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FFB1C4DFB42, 00007FFB1C4DFB64, 00007FFB1C4DFC5D

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_zallocR_put_error
String ID: ..\s\ssl\ssl_ciph.c
API String ID: 3070865948-1847046956
Opcode ID: e0d0190c8fcf74b9431766ed32747dd03f458b435c5093881e7f7d9e2c932f87
Instruction ID: 00389767b8f7ed37ffc3251120dbbeb4725da7e6c9283239eb30cbdaa3a492a1
Opcode Fuzzy Hash: e0d0190c8fcf74b9431766ed32747dd03f458b435c5093881e7f7d9e2c932f87
Instruction Fuzzy Hash: 47416AF2608B4186FA24DB21E5582B87BA6FB64BD4F658436DE4C83745EF38E561C700

Function 00007FFB1C4CDFF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4CE072
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4CE11B
CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4CE12F

Strings

..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FFB1C4CE015

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_malloc$O_free
String ID: ..\s\ssl\record\ssl3_buffer.c
API String ID: 2640950527-837614940
Opcode ID: dee3ef2ad7adbdc8e66446523c751e178c084310f4b4ed4408667be3f436cb4a
Instruction ID: 4c8f65d900acf61f8862c8d01aad6e6a55c62b9ddd740ad84b7987e8ae6f706c
Opcode Fuzzy Hash: dee3ef2ad7adbdc8e66446523c751e178c084310f4b4ed4408667be3f436cb4a
Instruction Fuzzy Hash: BD415EF2A09B8185EB609B22D9483A962E2FB44B98F144435DE8C47B9ADF3CD561C748

Function 00007FFB1C51AE6C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C51AF2A
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FFB1C51AF4F

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFB1C51AF60, 00007FFB1C51AFDE
D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFB1C51AF1D, 00007FFB1C51AF43

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\statem\statem_srvr.c$D:\_w\1\s\ssl\packet_local.h
API String ID: 3962629258-119891211
Opcode ID: 849f00e1f7a6a8e6497721987f6462b50dcc98e956b03f2f5cb25ab6169da610
Instruction ID: bed315e7ffe21b280a9fbac83daacb4bd429ec2cc61aadf7934f904344463882
Opcode Fuzzy Hash: 849f00e1f7a6a8e6497721987f6462b50dcc98e956b03f2f5cb25ab6169da610
Instruction Fuzzy Hash: 6C41C2B2B1DB8182E7018B21F4452E9B3A5FB847A4F585235FE8D17B5AEF3CD1918700

Function 00007FFB1C50AB30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C50AC77
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C50AC7F

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50AB6D, 00007FFB1C50ABA7

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeY_free
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 1826982404-1507966698
Opcode ID: 21689d50f801642794b53b85feec4120822639643fe654269ad578df4276d532
Instruction ID: 33d9583989e04907e1328dc2a57b480d404477dee5bbab123c9fe0e3ef80f49d
Opcode Fuzzy Hash: 21689d50f801642794b53b85feec4120822639643fe654269ad578df4276d532
Instruction Fuzzy Hash: 95318CF160CA8186E7609F22E4466E96B52FB88BE4F640134EE8C57B56DF7CE2118B04

Function 00007FFB1C4C1AC3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4E6655
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E667D
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E6706

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4E664E, 00007FFB1C4E6662, 00007FFB1C4E66FC

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_mallocR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2160744234-1080266419
Opcode ID: de1d524a60ff4933d46e7b11233379e3366d78e06219dfa61587fb3b62082733
Instruction ID: 03612d3f20ce3a373d862c1c5138dcb6f4bf85cdfd85eeb6fa3275c0c38814ae
Opcode Fuzzy Hash: de1d524a60ff4933d46e7b11233379e3366d78e06219dfa61587fb3b62082733
Instruction Fuzzy Hash: AD319CF2A0DB45C2EA50CF35D0582E867A6FB44BA8F6A4431DA4D43794EF3DE661C700

Function 00007FFB1C50CB60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C50CB8C
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C50CBFA
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C50CC4F

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50CBBB

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$X_free
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 306345296-1507966698
Opcode ID: 68f0022323a630d25dedeaac58d16e7c68c5ce8b5a96e07887ab94a87734ff7b
Instruction ID: 8c69a3d79ce3d0b368cc79264df4c894973158b44024727e73259dfa0045b64e
Opcode Fuzzy Hash: 68f0022323a630d25dedeaac58d16e7c68c5ce8b5a96e07887ab94a87734ff7b
Instruction Fuzzy Hash: DA31C5F170CA5182F7608B65E5453AAA3A2FB85BD4F144135EF8C47B86CF3DE5618B04

Function 00007FFB1C4C1974 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4FDA7C
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FFB1C4FDAA8

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFB1C4FDAE2
D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFB1C4FDA75, 00007FFB1C4FDA9C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\statem\extensions_clnt.c$D:\_w\1\s\ssl\packet_local.h
API String ID: 3962629258-2231994545
Opcode ID: 6cb3a5c37c5a5f4861fa33f87688d4d5d6d94207040461095e02455471613dac
Instruction ID: b771990c1ccfdafd333f9dbe255c3efc12e8f0aef7ca48f62fa3ab8aab7cb600
Opcode Fuzzy Hash: 6cb3a5c37c5a5f4861fa33f87688d4d5d6d94207040461095e02455471613dac
Instruction Fuzzy Hash: E621C2B2E1CA8081E7418F68E4456E9A7A1FB85794F144130EADD17756EF7CE1A1C704

Function 00007FFB1C4C1E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4EB61A
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4EB647
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FFB1C4EB661

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4EB60A, 00007FFB1C4EB633, 00007FFB1C4EB657

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_strdupR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 626504629-1080266419
Opcode ID: fbbe5d7c26e25c5a10368c9725ba53a0c1adef2fb14d5f8615d0f56703772c47
Instruction ID: dcc12b493361da53d2a08544d9e50cd124d70bacb40db879c29e54c89206d669
Opcode Fuzzy Hash: fbbe5d7c26e25c5a10368c9725ba53a0c1adef2fb14d5f8615d0f56703772c47
Instruction Fuzzy Hash: B42106E1B0CA8181FB508B34E5493F863A2FB447A8F698431DB5C87B91EF2CD5A1C304

Function 00007FFB1C4E1A90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E1B3C
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FFB1C4E1B51

Part of subcall function 00007FFB1C4C2090: ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F2AA3
Part of subcall function 00007FFB1C4C2090: BIO_s_file.LIBCRYPTO-1_1 ref: 00007FFB1C4F2ACB
Part of subcall function 00007FFB1C4C2090: BIO_new.LIBCRYPTO-1_1 ref: 00007FFB1C4F2AD3
Part of subcall function 00007FFB1C4C2090: ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F2AFB
Part of subcall function 00007FFB1C4C2090: X509_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F2C70
Part of subcall function 00007FFB1C4C2090: BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F2C78

Strings

..\s\ssl\ssl_conf.c, xrefs: 00007FFB1C4E1B35, 00007FFB1C4E1B47
gfffffff, xrefs: 00007FFB1C4E1B0D

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free$O_newO_s_fileO_strdupR_clear_errorR_put_errorX509_free
String ID: ..\s\ssl\ssl_conf.c$gfffffff
API String ID: 3738848979-4123734156
Opcode ID: 3e74ce29dac1667ab7411bc9231c141245e609231d85bdfdd479e12d8fcee6c4
Instruction ID: bdfb023f34e4dd998eacc4b9a5ca9214af5b3dcdb72b4242dfeb2076a88b8e4e
Opcode Fuzzy Hash: 3e74ce29dac1667ab7411bc9231c141245e609231d85bdfdd479e12d8fcee6c4
Instruction Fuzzy Hash: FB21AEE6B09B4585EF44DF66E4482A867A2EF88FD4F290435DE0DC73A6DF2CD5108340

Function 00007FFB1C513CC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C513D07
memcpy.VCRUNTIME140 ref: 00007FFB1C513D7D

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFB1C513CEA
J, xrefs: 00007FFB1C513D14

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_mallocmemcpy
String ID: ..\s\ssl\statem\statem_lib.c$J
API String ID: 1834057931-671735911
Opcode ID: b77902d932c05bc8c1d59d2639045b1ef3b827f168efe6d14f4eb2dc2d482d94
Instruction ID: bdd3a07e038ec5023dd6767d9ece7ede4ec0c1aeb95b7788880a57df175c7f1c
Opcode Fuzzy Hash: b77902d932c05bc8c1d59d2639045b1ef3b827f168efe6d14f4eb2dc2d482d94
Instruction Fuzzy Hash: 3A21B362A08B8192E710CF21E4056E9B761FB98BD8F549231EF8C13757EF38E296C704

Function 00007FFB1C4D6DB7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D6DD2
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FFB1C4D6E4A

Strings

, xrefs: 00007FFB1C4D6DC5
..\s\ssl\s3_lib.c, xrefs: 00007FFB1C4D6DBE, 00007FFB1C4D6E40

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_strdup
String ID: $..\s\ssl\s3_lib.c
API String ID: 2148955802-2670486660
Opcode ID: c3f50af1f466f1ed729976a13e6249ee9202de92f8f276ccf113ef1ae1e7680d
Instruction ID: 25521799ba7b0698901782024bf2596b18ceb9fceafc18c555d2a30f319f9259
Opcode Fuzzy Hash: c3f50af1f466f1ed729976a13e6249ee9202de92f8f276ccf113ef1ae1e7680d
Instruction Fuzzy Hash: 641126E1A1DE8345FB259A34D0193FCA6A3FB20BA8F240438DD4DC6AC6DF2DD6518710

Function 00007FFB1C4C1E79 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4CE3FD
CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4CE411

Strings

..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FFB1C4CE3DF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_malloc
String ID: ..\s\ssl\record\ssl3_buffer.c
API String ID: 2609694610-837614940
Opcode ID: 335097e35967ace2141d3d9512ed1125cd24ec3aeb063d5d777ebf705f495e7d
Instruction ID: b1e69701ad7b4e50b7ad805c3bbf688dd09566dc2eec6e37125c85240157c3bb
Opcode Fuzzy Hash: 335097e35967ace2141d3d9512ed1125cd24ec3aeb063d5d777ebf705f495e7d
Instruction Fuzzy Hash: 7B3173F2A0DB4181E7608B61E4443A966A2FF44BE8F244534DE9C07BAADF3CE561C748

Function 00007FFB1C4C101E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4EA713
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4EA757

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4EA6B6, 00007FFB1C4EA6CC, 00007FFB1C4EA706, 00007FFB1C4EA74A

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2581946324-1080266419
Opcode ID: 854e67b2b9c398a470d12a0e76ce9acca761e42a2ffbda13f24555cf464e9889
Instruction ID: 28e5b7378d81bbb0bcdf2012059b4f996165f1d52aea25c4fdb9b926cc6cf05b
Opcode Fuzzy Hash: 854e67b2b9c398a470d12a0e76ce9acca761e42a2ffbda13f24555cf464e9889
Instruction Fuzzy Hash: 2021A4F5A08A9682EB508F31E406BF867A2EB817A8F690031DE4C17B95DF3DD661C704

Function 00007FFB1C508C82 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C508D5E
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C508D9E

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C508D51

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 2581946324-1507966698
Opcode ID: d93633eb9129b941e8b7c74014dd0808034ae84822612ee33a64904c3a930e50
Instruction ID: 84475479b84d275c560cea4467354db1ffdc9768c4f7c125b76c9a2255c2f087
Opcode Fuzzy Hash: d93633eb9129b941e8b7c74014dd0808034ae84822612ee33a64904c3a930e50
Instruction Fuzzy Hash: AF31C5F2A2CB8145D7608B21E4056AAB7A2FB857E4F144235EACD57B49DF7CD1A0CB04

Function 00007FFB1C4C1D5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C50A90C

Part of subcall function 00007FFB1C4C1C03: CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4D86E9
Part of subcall function 00007FFB1C4C1C03: memset.VCRUNTIME140 ref: 00007FFB1C4D8717
Part of subcall function 00007FFB1C4C1C03: memcpy.VCRUNTIME140 ref: 00007FFB1C4D8753
Part of subcall function 00007FFB1C4C1C03: CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D8776
Part of subcall function 00007FFB1C4C1C03: CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D87DD
Part of subcall function 00007FFB1C4C1C03: CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D8858

Strings

;, xrefs: 00007FFB1C50A8BD
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50A865

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_clear_free$O_mallocmemcpymemset
String ID: ..\s\ssl\statem\statem_clnt.c$;
API String ID: 2470733610-2335744092
Opcode ID: 7443c70fe2c631efb4332faaa1f35136e2a783922a74b8694da0c8455bf7ea8a
Instruction ID: caae7900836d706d4198d463e6146d4de1dd100b9a2bb980ecc1fe1929c59190
Opcode Fuzzy Hash: 7443c70fe2c631efb4332faaa1f35136e2a783922a74b8694da0c8455bf7ea8a
Instruction Fuzzy Hash: BD2160B1B08B4281E7908B66D54A7E967A2FF44BE4F244131DE8D97B96CF3CE1528700

Function 00007FFB1C4C1BC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FFB1C4E2457
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E2485

Strings

..\s\ssl\ssl_conf.c, xrefs: 00007FFB1C4E244D, 00007FFB1C4E2478

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_strdup
String ID: ..\s\ssl\ssl_conf.c
API String ID: 2148955802-1527728938
Opcode ID: b88146338fba586e0227d2b5e84c457c10894e8e9c18c16a582ee8ed0522ea4b
Instruction ID: 4e611e285a4b2cb2ba418aae6bb815916f9967b4dd51eba646ed9dd012160ce4
Opcode Fuzzy Hash: b88146338fba586e0227d2b5e84c457c10894e8e9c18c16a582ee8ed0522ea4b
Instruction Fuzzy Hash: 5411CAE1F0CB4285EB618765F0483689792AF447E4F255034EB9D47B55DF6CD6608300

Function 00007FFB1C4D7F50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1(?,00007FFB1C4D646B), ref: 00007FFB1C4D7F85
CRYPTO_memdup.LIBCRYPTO-1_1(?,00007FFB1C4D646B), ref: 00007FFB1C4D7FC0

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFB1C4D7F71, 00007FFB1C4D7FB3

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\s3_lib.c
API String ID: 3962629258-4238427508
Opcode ID: 8ffaf67e594691b3e3d853aa11b6b199acf629925e887ef328c4812bd6557412
Instruction ID: 36f75f730e16db0bf36785fdc3a3effcc15d7c116c07b81e5ee5c4ee5e8a26e0
Opcode Fuzzy Hash: 8ffaf67e594691b3e3d853aa11b6b199acf629925e887ef328c4812bd6557412
Instruction Fuzzy Hash: 1D0182B1B09F8291FB959B25E4453E8A2A1FF48B94F584034EF5C87B89DF2CD561C300

Function 00007FFB1C4C1C8A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F3BF5
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FFB1C4F3C17

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFB1C4F3BE1, 00007FFB1C4F3C0A

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\ssl_sess.c
API String ID: 3962629258-2868363209
Opcode ID: 75ae5151c3ec916b1e3cf4631fb0efc9eee2f7293af43f61a3ca226e3b739b7d
Instruction ID: 02ccc1635f068cc3ce12ef1eff40a29cb19b7d9f839a2c1fb42aa191a4ef83e5
Opcode Fuzzy Hash: 75ae5151c3ec916b1e3cf4631fb0efc9eee2f7293af43f61a3ca226e3b739b7d
Instruction Fuzzy Hash: 7C1182F2B19F8181E7918B25E5992E963A5EB44FE8F280030EE9C4BB59DF2CD551C700

Function 00007FFB1C4C102D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4CFC72
COMP_expand_block.LIBCRYPTO-1_1 ref: 00007FFB1C4CFC9C

Strings

..\s\ssl\record\ssl3_record.c, xrefs: 00007FFB1C4CFC66

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_mallocP_expand_block
String ID: ..\s\ssl\record\ssl3_record.c
API String ID: 3543690440-2721125279
Opcode ID: 69f0180adb2f037e8dbda198ea36c325335dcf22a51305bd4ac3471ac81ea566
Instruction ID: 3feee6d44cafd0bc654d34083fe9a544c09c024e2cd41481079c3f16ccd46e1b
Opcode Fuzzy Hash: 69f0180adb2f037e8dbda198ea36c325335dcf22a51305bd4ac3471ac81ea566
Instruction Fuzzy Hash: 710169E2B18E0182E7508F71E1483A963A5FB08BD8F244031EF4C8B39AEF2DD4A08744

Function 00007FFB1C4D9E20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1(00000000,00007FFB1C4D951D), ref: 00007FFB1C4D9E4E
CRYPTO_strndup.LIBCRYPTO-1_1(00000000,00007FFB1C4D951D), ref: 00007FFB1C4D9E71

Strings

..\s\ssl\ssl_asn1.c, xrefs: 00007FFB1C4D9E41, 00007FFB1C4D9E60

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_strndup
String ID: ..\s\ssl\ssl_asn1.c
API String ID: 2641571835-3659835543
Opcode ID: 4597588dcaa3a4f05fb93746b93c36628af5380aa5c367307f0226704981bf83
Instruction ID: d8611b1dda50896253bf3effebf4a137abacef2bd45278167d358d649c41658c
Opcode Fuzzy Hash: 4597588dcaa3a4f05fb93746b93c36628af5380aa5c367307f0226704981bf83
Instruction Fuzzy Hash: 8401D6B2B19E8181EB408B65F5452A86371EB48FE4F185032FF4D93B99DF3CD5A08700

Function 00007FFB1C5009E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C500A17
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FFB1C500A40

Strings

D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFB1C500A07, 00007FFB1C500A30

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\_w\1\s\ssl\packet_local.h
API String ID: 3962629258-1466776524
Opcode ID: 3086be79aa084bd735b56c70232b86d486ba490f9d4d82315a67abae6e704363
Instruction ID: 868dc84ecad3c94abc3ea2b2dcb54956ceb5dcc7ec62eea29a2c028dea2df525
Opcode Fuzzy Hash: 3086be79aa084bd735b56c70232b86d486ba490f9d4d82315a67abae6e704363
Instruction Fuzzy Hash: 8A0121B2716F4181EB508F21E88569963A5FB98BD0F189031EE9C87B55DE3CD560C700

Function 00007FFB1C4E3C10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E3C47
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FFB1C4E3C70

Strings

D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFB1C4E3C37, 00007FFB1C4E3C60

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\_w\1\s\ssl\packet_local.h
API String ID: 3962629258-1466776524
Opcode ID: 6eb42d5ed19abbe55e1d96f8a06e36156e50a06829169304fdd9cd2b339d9c4f
Instruction ID: a82e377b57c72d9dd6615c26cdc0da80ed73b37cefc31b96a2d872a41a3c0e42
Opcode Fuzzy Hash: 6eb42d5ed19abbe55e1d96f8a06e36156e50a06829169304fdd9cd2b339d9c4f
Instruction Fuzzy Hash: EC0121B271AF4181EB518F11E88529963A5FB98BD0F188031EE8C87B55DF3CD560C700

Function 00007FFB1C518BA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C518BD7
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FFB1C518C00

Strings

D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFB1C518BC7, 00007FFB1C518BF0

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\_w\1\s\ssl\packet_local.h
API String ID: 3962629258-1466776524
Opcode ID: e8f27b4bf680b1f3519b96dfa4ec951aa5b9b80ac038fe1aa0c6ec84dbf5744c
Instruction ID: 0c4b73b92a632d86903fe8b41974652e1c705164fdeddab84cc1bd04990d4cc4
Opcode Fuzzy Hash: e8f27b4bf680b1f3519b96dfa4ec951aa5b9b80ac038fe1aa0c6ec84dbf5744c
Instruction Fuzzy Hash: 480121B2716F41C1EB508F11E88529973A5FB98BD0F189431EE8C87B55DE3CD550C700

Function 00007FFB1C5074B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1(?,00007FFB1C50D1FE), ref: 00007FFB1C5074E7
CRYPTO_memdup.LIBCRYPTO-1_1(?,00007FFB1C50D1FE), ref: 00007FFB1C507510

Strings

D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFB1C5074D7, 00007FFB1C507500

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\_w\1\s\ssl\packet_local.h
API String ID: 3962629258-1466776524
Opcode ID: 954f8f06da854b4db8d39e0345422f4e212c9f11fce1b852f446e113eacadc1a
Instruction ID: 1415ce97ab62eab8486b6066e2d244502acfe09a910bc347bac74a35ed4b8e60
Opcode Fuzzy Hash: 954f8f06da854b4db8d39e0345422f4e212c9f11fce1b852f446e113eacadc1a
Instruction Fuzzy Hash: 430121B2716F4181EB508F21F88529963A5FB99BD0F189031EE8C87B56DE3CD561C700

Function 00007FFB1C4C189D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4C8CB7
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4C8CDF

Strings

..\s\ssl\pqueue.c, xrefs: 00007FFB1C4C8CAD, 00007FFB1C4C8CC4

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_mallocR_put_error
String ID: ..\s\ssl\pqueue.c
API String ID: 2513334388-354262084
Opcode ID: e0e4adb6d0e4d3880cc9d54d094c15b6ee82e48b3030a9f27fa013b8e6751dcb
Instruction ID: dfd50d04d740ee81146109c1dff5510c70824ac785fc2f23993c8be5abfb8d53
Opcode Fuzzy Hash: e0e4adb6d0e4d3880cc9d54d094c15b6ee82e48b3030a9f27fa013b8e6751dcb
Instruction Fuzzy Hash: A1018FF6B09A4286EB408B25E5493E973A1EB44794F644032DB5C03792EF3CE658CB00

Function 00007FFB1C518DC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C518DE9
CRYPTO_strndup.LIBCRYPTO-1_1 ref: 00007FFB1C518E02

Strings

D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFB1C518DDF, 00007FFB1C518DF2

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_strndup
String ID: D:\_w\1\s\ssl\packet_local.h
API String ID: 2641571835-1466776524
Opcode ID: 322d0387f069dd3dcf3ebb5ecde614a15ec830c25c0d0b5378a2d2d825049c60
Instruction ID: a931b2b25dab7401597d7ae780626b66e514c69de8af9858211ddc5f82cb8196
Opcode Fuzzy Hash: 322d0387f069dd3dcf3ebb5ecde614a15ec830c25c0d0b5378a2d2d825049c60
Instruction Fuzzy Hash: 29F0A0F6B09E0281EF449B61E4966E86362EF48BD4F648032EE0C877A6DE2CC461C300

Function 00007FFB1C500BD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C500BF9
CRYPTO_strndup.LIBCRYPTO-1_1 ref: 00007FFB1C500C12

Strings

D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FFB1C500BEF, 00007FFB1C500C02

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_strndup
String ID: D:\_w\1\s\ssl\packet_local.h
API String ID: 2641571835-1466776524
Opcode ID: f56a1b98d1662482baa83ba3edd8505c44ae602fbc20fc0fa62332b9d7dd1a7e
Instruction ID: a931b2b25dab7401597d7ae780626b66e514c69de8af9858211ddc5f82cb8196
Opcode Fuzzy Hash: f56a1b98d1662482baa83ba3edd8505c44ae602fbc20fc0fa62332b9d7dd1a7e
Instruction Fuzzy Hash: 29F0A0F6B09E0281EF449B61E4966E86362EF48BD4F648032EE0C877A6DE2CC461C300

Function 00007FFB1C4D6E83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D6EAA
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FFB1C4D6EBF

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFB1C4D6EA3, 00007FFB1C4D6EB5

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_strdup
String ID: ..\s\ssl\s3_lib.c
API String ID: 2148955802-4238427508
Opcode ID: cfa6b542906678eadd0cba0ae2b8d523b63035c610f9064f67042435aea65508
Instruction ID: 226259052f1f42ad80b61b9761fda5da6b7a747ea90936dec4383d516875f4b2
Opcode Fuzzy Hash: cfa6b542906678eadd0cba0ae2b8d523b63035c610f9064f67042435aea65508
Instruction Fuzzy Hash: 68F017E1A2DF4385FB21AF24E0553F8A3A2AF40BA8FA40031D94C4A795EF6DE255C740

Function 00007FFB1C4EC930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4EC952
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4EC96F

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4EC942, 00007FFB1C4EC95B

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2581946324-1080266419
Opcode ID: 21e02bb78b288009886ceffcbf45223289c710beffcb0b3e00a4d35bf09acb4f
Instruction ID: a7d1335e9422d134fbb506bace70a1954a27d82b4be0dc08f1b2d75929f1c6ac
Opcode Fuzzy Hash: 21e02bb78b288009886ceffcbf45223289c710beffcb0b3e00a4d35bf09acb4f
Instruction Fuzzy Hash: D7E092E5B04F4180EB016B71D44A3E823A2DB45BA8F644030DD4C4B38ADF6CC184C312

Function 00007FFB1C4C1FB9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C528276

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFB1C52825F

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\t1_lib.c
API String ID: 2581946324-1643863364
Opcode ID: 4af2162af656f9a7584b100ba4c9b54a640417340fd3c2c230b4a699037e6658
Instruction ID: 3df4e77f722dfb550a42c1fef853c192559e033692d5669c5991011c6fa07fbe
Opcode Fuzzy Hash: 4af2162af656f9a7584b100ba4c9b54a640417340fd3c2c230b4a699037e6658
Instruction Fuzzy Hash: DD6170F2A08E91C6E7658F61D84A3E967E6FB44BA8F680035EA4D47784CF7CE581C341

Function 00007FFB1C4C1A64 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C50581C

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFB1C505807, 00007FFB1C50587C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions_srvr.c
API String ID: 2581946324-1853348325
Opcode ID: 84a87d2f9c97edac55d573d6288c87b2718ce8c1a7b5ee754dda74137a2b3bb7
Instruction ID: 3015b84a795fd9428c9804117314271e039a148238221b38b2f15b32ba1acfde
Opcode Fuzzy Hash: 84a87d2f9c97edac55d573d6288c87b2718ce8c1a7b5ee754dda74137a2b3bb7
Instruction Fuzzy Hash: D431E7F2A18A8182E7908B21E0497ED7762FB80758F604131EB8D93B89DF3CE1B5C704

Function 00007FFB1C508947 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C5089B7

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C5089A5, 00007FFB1C508A57

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_malloc
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 1457121658-1507966698
Opcode ID: 2bddd7ba364043542012fdf4a58a0e97aac944aa145ed775f271abf5edf17cb6
Instruction ID: 7e01a19e3ffa8cfff0617d17e80b771d6b41eec15e6f0bc3b46c2e1f76a25838
Opcode Fuzzy Hash: 2bddd7ba364043542012fdf4a58a0e97aac944aa145ed775f271abf5edf17cb6
Instruction Fuzzy Hash: 9E31E8F2608F4185F7608F22E8066BD7792EB81BA4F684236CA9D87B95DF3CD165C700

Function 00007FFB1C4C1E24 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C50CD9E

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50CD8C, 00007FFB1C50CE09

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_malloc
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 1457121658-1507966698
Opcode ID: 896d462ff5903d05cd5500c63a4c649c34665a049f6d22023f7cb1ce2d201c19
Instruction ID: c9e2ef0b1b8e566590036c0cfdb612aee160e9d0531c9e3a122994db05dd8487
Opcode Fuzzy Hash: 896d462ff5903d05cd5500c63a4c649c34665a049f6d22023f7cb1ce2d201c19
Instruction Fuzzy Hash: DC31E4F2709F9185E7509F26E4052BD7BA2EB46B90F684132DA4C97795DE2CE1A1C301

Function 00007FFB1C4C1078 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4FACA5

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFB1C4FAC22

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 2581946324-592572767
Opcode ID: fbd7a46970a1ef4e1f8adc7dd2b963006a440b2e12e7e168f897cd4f3e294671
Instruction ID: 1ac95a8dfb1ea0bca10bd374705d3d7e5895c36826940617948e595459ca25a8
Opcode Fuzzy Hash: fbd7a46970a1ef4e1f8adc7dd2b963006a440b2e12e7e168f897cd4f3e294671
Instruction Fuzzy Hash: A6216DF1A0C94182E7109B26E0593EA63A6EF45FE8F240031DE4C4BBA6CE6CD4519B44

Function 00007FFB1C4C8980 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1(00007FFB1C4C7BCF), ref: 00007FFB1C4C8A49

Strings

..\s\ssl\packet.c, xrefs: 00007FFB1C4C8A35

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\packet.c
API String ID: 2581946324-1434567093
Opcode ID: d929772ba9d9cd30569ecbe6f7836af456e130a0bae61b480dc3e9e37bd8ed97
Instruction ID: 6bd635ea9265f52506336c628e5e9478c47e004332604887384ea13034378ee8
Opcode Fuzzy Hash: d929772ba9d9cd30569ecbe6f7836af456e130a0bae61b480dc3e9e37bd8ed97
Instruction Fuzzy Hash: 42215EF6B19F4581EF558B65C088BB823A6FF55BA4F628032DE5C43352EE3AD960C304

Function 00007FFB1C4D7B50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FFB1C4D7B74

Part of subcall function 00007FFB1C4C1DBB: BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C7A2
Part of subcall function 00007FFB1C4C1DBB: BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C7D2
Part of subcall function 00007FFB1C4C1DBB: BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C800
Part of subcall function 00007FFB1C4C1DBB: BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C821
Part of subcall function 00007FFB1C4C1DBB: BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C842
Part of subcall function 00007FFB1C4C1DBB: BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C85F
Part of subcall function 00007FFB1C4C1DBB: BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C87F
Part of subcall function 00007FFB1C4C1DBB: BN_dup.LIBCRYPTO-1_1 ref: 00007FFB1C52C89F

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFB1C4D7B62

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: N_dup$O_zalloc
String ID: ..\s\ssl\s3_lib.c
API String ID: 3577659955-4238427508
Opcode ID: 6f265d6533fcfcc531d5e65a74dae97ba3647e37df6ad2cf12121d5eee69d0c7
Instruction ID: 762cc42bd17be49b578f7ce4107389d0c271c977b97149848c8cd165504907e3
Opcode Fuzzy Hash: 6f265d6533fcfcc531d5e65a74dae97ba3647e37df6ad2cf12121d5eee69d0c7
Instruction Fuzzy Hash: CCF0A0D1B19B0342FF486BB2D85A2F812919F48B64F184034DD0DCB3C6EE1CD8E18220

Function 00007FFB1C4CAEB0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4CAEF3

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFB1C4CAEE6

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 2581946324-1306860146
Opcode ID: 0242b5e0710e5b9ed5d25ec5364f3a4e319912c8dbaebd16ff8c9e65dc56dc40
Instruction ID: 1aa0195982280478209c66e593ca0b98df7ad0b84a84119bdd1bece8483ac8d9
Opcode Fuzzy Hash: 0242b5e0710e5b9ed5d25ec5364f3a4e319912c8dbaebd16ff8c9e65dc56dc40
Instruction Fuzzy Hash: 7EF054D1B0C94241EB40AB66E55A2F85252AF84BD8F685031FD0D4B7A7DD1CD4A18714

Function 00007FFB1C4C1F0F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB1C4C192E: CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C9405
Part of subcall function 00007FFB1C4C192E: CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C941B
Part of subcall function 00007FFB1C4C192E: CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C9465
Part of subcall function 00007FFB1C4C192E: CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C947B
Part of subcall function 00007FFB1C4C192E: CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C94C5
Part of subcall function 00007FFB1C4C192E: CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C94DB

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C6502

Strings

..\s\ssl\d1_lib.c, xrefs: 00007FFB1C4C64F5

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\d1_lib.c
API String ID: 2581946324-490761327
Opcode ID: 957c9f67d5a53124e95ed17d7b1fc2991a9f016454fd4be57342793adaad36eb
Instruction ID: 514a27be3e5e8e9f18ba59336a8a3160069b82ea31053560cbe449d43a94b042
Opcode Fuzzy Hash: 957c9f67d5a53124e95ed17d7b1fc2991a9f016454fd4be57342793adaad36eb
Instruction Fuzzy Hash: 81F0F4D5A0CE4240EB10AB71D4593F92312EF84B5DF285031DD0D4B2A7CF2CE1518319

Function 00007FFB1C4C7A50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C7A80

Strings

..\s\ssl\packet.c, xrefs: 00007FFB1C4C7A73

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\packet.c
API String ID: 2581946324-1434567093
Opcode ID: 3ff7da4bd6e107f1824642eccebb4c47cd1415cb3427f4966d444bf657803e21
Instruction ID: b412e0815245b8738b46a4ffb793d4eb994cdd26cd89043c92c0d1a7f55a4007
Opcode Fuzzy Hash: 3ff7da4bd6e107f1824642eccebb4c47cd1415cb3427f4966d444bf657803e21
Instruction Fuzzy Hash: 35E09BD5B1DE4182FF549B65E4457B45361AF48BA4F2C0030EE4D87793EE2CD5604304

Function 00007FFB1C4C1CB7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D4294

Strings

..\s\ssl\s3_enc.c, xrefs: 00007FFB1C4D4272

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_clear_free
String ID: ..\s\ssl\s3_enc.c
API String ID: 2011826501-1839494539
Opcode ID: 165d2f9162a7ea0e1b883355fcadd9ae293218281c6e296ef982dc1cd87a5a06
Instruction ID: 08d6f78c51ed931e67d61f5bc792943af35f0048f4b085e71f6f0d120b82876b
Opcode Fuzzy Hash: 165d2f9162a7ea0e1b883355fcadd9ae293218281c6e296ef982dc1cd87a5a06
Instruction Fuzzy Hash: F5F0E5F570DB4094DB409B65D4893E83361EB49FA4F685132DE4D8B361CF25D157C305

Function 00007FFB1C4DCC50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CRYPTO_get_ex_new_index.LIBCRYPTO-1_1 ref: 00007FFB1C4DCC7A

Strings

SSL for verify callback, xrefs: 00007FFB1C4DCC61

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_get_ex_new_index
String ID: SSL for verify callback
API String ID: 3987194240-2900698531
Opcode ID: a6011a626377f88d4f36762ba213be3b3082f72e1376bbc52cc525c91ab5a9e1
Instruction ID: 8c53966170b86fe839d3f5edab19ca685b52bd224d8e9090d1844fca69ba662e
Opcode Fuzzy Hash: a6011a626377f88d4f36762ba213be3b3082f72e1376bbc52cc525c91ab5a9e1
Instruction Fuzzy Hash: 59E092F6E09A018BE3119FB0E8866EA33A6FF48364F544139E94C83760DF3CB610C614

Function 00007FFB1C4F79B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F79DD

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFB1C4F79C2

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions.c
API String ID: 2581946324-1165805907
Opcode ID: 2f97e86c93c34d52b1a362603061b6db55362eb8000c431305e46eabefbc0c4e
Instruction ID: b8cde9a55acb7d09dbe847acbd0fdfd124d2cd3161c901da4c1916f5bc80ef78
Opcode Fuzzy Hash: 2f97e86c93c34d52b1a362603061b6db55362eb8000c431305e46eabefbc0c4e
Instruction Fuzzy Hash: 40E092A2705B41C5DB409B69D4893F833B1EF48F94F1C8032EE4C8B352CF24C1568304

Function 00007FFB1C4F7A20 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F7A4D

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFB1C4F7A32

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions.c
API String ID: 2581946324-1165805907
Opcode ID: 2a8433d0dd4678d2421f0db5fbda3d2d10e92d67abf67099d70fd35a674426fb
Instruction ID: 08dbf15a56f78fcb74adf810101af10bbd26b7eba94c9288b03538fc101df7f8
Opcode Fuzzy Hash: 2a8433d0dd4678d2421f0db5fbda3d2d10e92d67abf67099d70fd35a674426fb
Instruction Fuzzy Hash: 5DE012A6705B8185DB809B69D4897F833A1EF48F94F284136DE9C8B762DE25C19A8305

Function 00007FFB1C4F7CC0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F7CE6

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFB1C4F7CD2

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions.c
API String ID: 2581946324-1165805907
Opcode ID: db0fe956fc95c7bb597eaf808b1b42eeb67e70354d44230793082714163d2f4b
Instruction ID: 77e987db3065cb8ebf85c37e6a419f9cbe178a8d95b7a663760aa5f832fbc9d3
Opcode Fuzzy Hash: db0fe956fc95c7bb597eaf808b1b42eeb67e70354d44230793082714163d2f4b
Instruction Fuzzy Hash: E5D05EDAF08A0181FB106BA5D44A3E41261EF48759F681031ED0C8A783DE6DE1968714

Function 00007FFB1C4CDEE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4CDF06

Strings

..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FFB1C4CDEF2

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\record\ssl3_buffer.c
API String ID: 2581946324-837614940
Opcode ID: 78a9721f0115ee766c80a874c705e0ef560ce6671a5d027f7ba8cc4a18824e29
Instruction ID: 274a0757713dd5b7259912b8f1fab2ccb4cbf2212584c273b61168a55b09840e
Opcode Fuzzy Hash: 78a9721f0115ee766c80a874c705e0ef560ce6671a5d027f7ba8cc4a18824e29
Instruction Fuzzy Hash: 57D05ED5F05E4181EB4067A5D84A3E41361AF48799F285034ED4C8A783DE1DD1958711

Function 00007FFB1C4C1069 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C527324

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFB1C52731D

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\t1_lib.c
API String ID: 2581946324-1643863364
Opcode ID: 3b0d10c15c195ccb103bdd780d190d1d910412a85ffa120c6e788c33e6bfa689
Instruction ID: 62e6cc2869cca76a61716d50729fbaf16de4ffad03ee4b8ce76c37eee58997cf
Opcode Fuzzy Hash: 3b0d10c15c195ccb103bdd780d190d1d910412a85ffa120c6e788c33e6bfa689
Instruction Fuzzy Hash: 8DD017D5A0A802C5FA91AAA1C84B6F82362AF88B64F780030ED0D862A29D1CE5569604

Function 00007FFB1C4CDE30 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4CDE50

Strings

..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FFB1C4CDE49

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\record\ssl3_buffer.c
API String ID: 2581946324-837614940
Opcode ID: 34e897e0ef76f020f9948f769c91aefed0d0823d076e00817083611c0ba51cbd
Instruction ID: 7b93c7bb321f2818090f45bef7a16e6c13e24fad21ff1d0a3371083f202cdd64
Opcode Fuzzy Hash: 34e897e0ef76f020f9948f769c91aefed0d0823d076e00817083611c0ba51cbd
Instruction Fuzzy Hash: 2ED0A7E6F0490281EF016B75D84A3E423629F44754F689030D90C87783DE2CD554C700

Function 00007FFB1C4E58B7 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-1_1 ref: 00007FFB1C4E58F0
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FFB1C4E5903

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: 4e75c2cc3dcd78353cbf722120e43716e84895dcef96119534044b485c816d9a
Instruction ID: fdfc2d96475a1886815dda30a705938748eb30fc15a37a8961e400c543b866f2
Opcode Fuzzy Hash: 4e75c2cc3dcd78353cbf722120e43716e84895dcef96119534044b485c816d9a
Instruction Fuzzy Hash: F4E0D8A2B08A8193D7499B35E95A2E8A364FB4C794F288031FF4C83796DE28C4618300

Function 00007FFB1C4C19FB Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_read_lock.LIBCRYPTO-1_1 ref: 00007FFB1C4F3FED
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FFB1C4F4012

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_read_lockD_unlock
String ID:
API String ID: 102331797-0
Opcode ID: b8c4ac7cf1b2dbfe33a68604b69180c5cd553f5088160e85e863534f4dca409a
Instruction ID: 1805609d0ccfb8bf103e03d35660541f02ba0eb011fc5a7f3ac4b90970f76579
Opcode Fuzzy Hash: b8c4ac7cf1b2dbfe33a68604b69180c5cd553f5088160e85e863534f4dca409a
Instruction Fuzzy Hash: E4E06CA270CD4146E7445B69D4457E95371EF54B54F2C4031FB1D47756CD28D4624701

Function 00007FFB1C4C18DE Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-1_1 ref: 00007FFB1C4E58F0
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FFB1C4E5903

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: 8e4d20cf5a6c9214aabd93502fac362fd5ab4c5d46fefae8342b2f0fe81e9227
Instruction ID: 8882422feb73e6afa7a52572aeb77fca8f6a1b3e82cf036150302d63070de271
Opcode Fuzzy Hash: 8e4d20cf5a6c9214aabd93502fac362fd5ab4c5d46fefae8342b2f0fe81e9227
Instruction Fuzzy Hash: D0E086E2B08A8192D7499B71E94A2E85365FF5C794F244030FF0D87792EE78D5708300

Function 00007FFB1C4C24F5 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-1_1 ref: 00007FFB1C4EAD80
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FFB1C4EAD93

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: 675af10bc45aaea1e984d8cf1229972b8e21d4e3d3b3f9b5a1b2a1fc983e6cdc
Instruction ID: 24e6bd9c1387c5c076231186cecb8808d9f1d642640d2193d25b8a92daed8c88
Opcode Fuzzy Hash: 675af10bc45aaea1e984d8cf1229972b8e21d4e3d3b3f9b5a1b2a1fc983e6cdc
Instruction Fuzzy Hash: 23E04FA2B0DA8581D7449A61E94A2E85361EF98BA4F285031FE1D87792DE38D5A18601

Function 00007FFB1C51C080 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CRYPTO_memcmp.LIBCRYPTO-1_1 ref: 00007FFB1C51C18C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_memcmp
String ID:
API String ID: 2788248766-0
Opcode ID: 4e77a446d7d37506c1ccc300d9cda7732a0cdbcd79fa1143063ab816109b78e6
Instruction ID: d7e2fa367f0b57534b22a39194ca7830078aa56a95278e0ffc170880b5764f16
Opcode Fuzzy Hash: 4e77a446d7d37506c1ccc300d9cda7732a0cdbcd79fa1143063ab816109b78e6
Instruction Fuzzy Hash: 0C21FCE2A5CBC185EB304778F45A2FDA7A1FF85764F145230EACC52A95DF2DE1908B04

Function 00007FFB1C4DA9F0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FFB1C4DAA0B

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_run_once
String ID:
API String ID: 1403826838-0
Opcode ID: b60c586a9795037330c10853bf9af55bdbdc6b713c55f32f5e5f20ac2541bcf2
Instruction ID: 9e173c432776539b53c71d8c7883eb05374bae10b1106f424a518bf6228514f8
Opcode Fuzzy Hash: b60c586a9795037330c10853bf9af55bdbdc6b713c55f32f5e5f20ac2541bcf2
Instruction Fuzzy Hash: AAE04FE4B0D80396FA44A738D85A1F92392AF45374F604234E80DC11A1DE1CB810C700

Function 00007FFB1C4C1B3B Relevance: 65.2, APIs: 20, Strings: 17, Instructions: 442COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_reset.LIBCRYPTO-1_1 ref: 00007FFB1C52A33F
EVP_CIPHER_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB1C52A362
EVP_CIPHER_CTX_reset.LIBCRYPTO-1_1 ref: 00007FFB1C52A3BA
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FFB1C52A44C
EVP_CIPHER_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB1C52A463
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C52A501
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FFB1C52A793
memcpy.VCRUNTIME140 ref: 00007FFB1C52A85A
memcpy.VCRUNTIME140 ref: 00007FFB1C52A879
memcpy.VCRUNTIME140 ref: 00007FFB1C52A962
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB1C52AAA2

Strings

res master, xrefs: 00007FFB1C52A8A1
CLIENT_EARLY_TRAFFIC_SECRET, xrefs: 00007FFB1C52A4EA
s hs traffic, xrefs: 00007FFB1C52A40D, 00007FFB1C52A85F
finished, xrefs: 00007FFB1C52AA2C
c e traffic, xrefs: 00007FFB1C52A3FF, 00007FFB1C52AA70
SERVER_TRAFFIC_SECRET_0, xrefs: 00007FFB1C52A48F
CLIENT_TRAFFIC_SECRET_0, xrefs: 00007FFB1C52A7BF
SERVER_HANDSHAKE_TRAFFIC_SECRET, xrefs: 00007FFB1C52A45A
CLIENT_HANDSHAKE_TRAFFIC_SECRET, xrefs: 00007FFB1C52A798
..\s\ssl\tls13_enc.c, xrefs: 00007FFB1C52A380, 00007FFB1C52A51B, 00007FFB1C52A580, 00007FFB1C52A5BE, 00007FFB1C52A5EE, 00007FFB1C52A700, 00007FFB1C52A746
s ap traffic, xrefs: 00007FFB1C52A3EA, 00007FFB1C52A840, 00007FFB1C52A942
EXPORTER_SECRET, xrefs: 00007FFB1C52A9C7
c ap traffic, xrefs: 00007FFB1C52A406, 00007FFB1C52A87E, 00007FFB1C52A8E4
c hs traffic, xrefs: 00007FFB1C52A7A6
exp master, xrefs: 00007FFB1C52A97E
e exp master, xrefs: 00007FFB1C52A6B6
EARLY_EXPORTER_SECRET, xrefs: 00007FFB1C52A725

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: memcpy$D_sizeX_newX_reset$L_cleanseO_ctrl
String ID: ..\s\ssl\tls13_enc.c$CLIENT_EARLY_TRAFFIC_SECRET$CLIENT_HANDSHAKE_TRAFFIC_SECRET$CLIENT_TRAFFIC_SECRET_0$EARLY_EXPORTER_SECRET$EXPORTER_SECRET$SERVER_HANDSHAKE_TRAFFIC_SECRET$SERVER_TRAFFIC_SECRET_0$c ap traffic$c e traffic$c hs traffic$e exp master$exp master$finished$res master$s ap traffic$s hs traffic
API String ID: 804632375-2823458745
Opcode ID: 8c13c8737bddab6e19d767a7b85691cb3e91b93f97c6634a5a6a42cfca930886
Instruction ID: 8efb80ebc857af8a6916c7368fa450406d63c973a445397fbee075228ab09f9f
Opcode Fuzzy Hash: 8c13c8737bddab6e19d767a7b85691cb3e91b93f97c6634a5a6a42cfca930886
Instruction Fuzzy Hash: 4B2268F2A08F42D5EB549F61E54A2E973A6FB447A8F600136EA8C47BA5DF3CE115C700

Function 00007FFB1C4C249B Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 224COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DB134
X509_STORE_new.LIBCRYPTO-1_1 ref: 00007FFB1C4DB142
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4DB157
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FFB1C4DB166
X509_STORE_add_cert.LIBCRYPTO-1_1 ref: 00007FFB1C4DB171
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4DB184
X509_STORE_add_cert.LIBCRYPTO-1_1 ref: 00007FFB1C4DB193
X509_STORE_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB1C4DB1D1
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DB1F9
X509_STORE_CTX_init.LIBCRYPTO-1_1 ref: 00007FFB1C4DB20F
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DB233
X509_verify_cert.LIBCRYPTO-1_1 ref: 00007FFB1C4DB251
ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DB26A
X509_STORE_CTX_get1_chain.LIBCRYPTO-1_1 ref: 00007FFB1C4DB277
OPENSSL_sk_shift.LIBCRYPTO-1_1 ref: 00007FFB1C4DB28A
X509_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DB292
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4DB2A0
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4DB2AC
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FFB1C4DB2B7
X509_get_extension_flags.LIBCRYPTO-1_1 ref: 00007FFB1C4DB2BF
OPENSSL_sk_pop.LIBCRYPTO-1_1 ref: 00007FFB1C4DB2CD
X509_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DB2D5
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4DB2DF
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FFB1C4DB2F9
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4DB323
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DB337
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DB36A
ERR_add_error_data.LIBCRYPTO-1_1 ref: 00007FFB1C4DB38D
X509_STORE_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DB3F3
X509_STORE_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DB3FB

Strings

Verify error:, xrefs: 00007FFB1C4DB381
..\s\ssl\ssl_cert.c, xrefs: 00007FFB1C4DB117, 00007FFB1C4DB1DE, 00007FFB1C4DB218, 00007FFB1C4DB35A, 00007FFB1C4DB394

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X509_$L_sk_num$R_put_error$L_sk_value$E_add_certX509_free$E_freeE_newL_sk_popL_sk_pop_freeL_sk_shiftR_add_error_dataR_clear_errorX509_get_extension_flagsX509_verify_certX_freeX_get1_chainX_initX_new
String ID: ..\s\ssl\ssl_cert.c$Verify error:
API String ID: 3914415273-2787608381
Opcode ID: 0f384e29d16ff4fe1c28bac90def104ab8e816b4f455eafee8cf21e50d296a3e
Instruction ID: 283edcd6b8da076a943fa24717f6848be0beaf27de4037ef241a65059a0fb713
Opcode Fuzzy Hash: 0f384e29d16ff4fe1c28bac90def104ab8e816b4f455eafee8cf21e50d296a3e
Instruction Fuzzy Hash: 3F917DE2A0CE4685FA54AE72D85E6FD1292EF55BA8F244135ED0E87B82DF3CE410C341

Function 00007FFB1C4D4980 Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 173COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D49C2
EVP_MD_CTX_new.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D49CA
memset.VCRUNTIME140(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4A1E
EVP_sha1.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4A27
EVP_DigestInit_ex.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4A35
EVP_DigestUpdate.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4A4D
EVP_DigestUpdate.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4A6C
EVP_DigestUpdate.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4A90
EVP_DigestUpdate.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4AB4
EVP_DigestFinal_ex.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4ACC
EVP_md5.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4AD9
EVP_DigestInit_ex.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4AE7
EVP_DigestUpdate.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4B06
EVP_DigestUpdate.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4B21
EVP_DigestFinal_ex.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4B40
OPENSSL_cleanse.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4B63
EVP_DigestFinal_ex.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4B8A
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4BA1
EVP_MD_CTX_free.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4C08
EVP_MD_CTX_free.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FFB1C4D5321), ref: 00007FFB1C4D4C10

Strings

", xrefs: 00007FFB1C4D4BD8
..\s\ssl\s3_enc.c, xrefs: 00007FFB1C4D4BE6
A, xrefs: 00007FFB1C4D49AE

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: Digest$Update$Final_ex$Init_exX_freeX_new$L_cleanseP_md5P_sha1memcpymemset
String ID: "$..\s\ssl\s3_enc.c$A
API String ID: 754518535-4125341915
Opcode ID: 30627095345bf87a13ed58d62043bbc66c10080e7d9ce7dc687f4bb24a99cb03
Instruction ID: 06bf9539879c303f912fc42ebe47ecf3bbcdd8a9308e35f7a7120c5d754fcb3d
Opcode Fuzzy Hash: 30627095345bf87a13ed58d62043bbc66c10080e7d9ce7dc687f4bb24a99cb03
Instruction Fuzzy Hash: C761CFE6B0CB4285F750AA32E4497FA1A82AF91BE8F642031FD8D877C6DE2CD151C701

Function 00007FFB1C4C105F Relevance: 38.6, APIs: 21, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-1_1 ref: 00007FFB1C4DAA5E
BIO_new.LIBCRYPTO-1_1 ref: 00007FFB1C4DAA66
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4DAAB0
PEM_read_bio_X509.LIBCRYPTO-1_1 ref: 00007FFB1C4DAACB
OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FFB1C4DAAE5
X509_get_subject_name.LIBCRYPTO-1_1 ref: 00007FFB1C4DAAFB
X509_NAME_dup.LIBCRYPTO-1_1 ref: 00007FFB1C4DAB0F
OPENSSL_LH_retrieve.LIBCRYPTO-1_1 ref: 00007FFB1C4DAB26
X509_NAME_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DAB33
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4DAB4D
PEM_read_bio_X509.LIBCRYPTO-1_1 ref: 00007FFB1C4DAB64
BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DAB75
X509_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DAB7F
OPENSSL_LH_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DAB87
ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DAB91
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DABC2
X509_NAME_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DABCA
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DABD9
BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DABE1
X509_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DABEB
OPENSSL_LH_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DABF3

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFB1C4DABB3

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X509_$E_freeH_freeM_read_bio_O_freeX509X509_free$E_dupH_retrieveL_sk_new_nullL_sk_pop_freeL_sk_pushO_ctrlO_newO_s_fileR_clear_errorR_put_errorX509_get_subject_name
String ID: ..\s\ssl\ssl_cert.c
API String ID: 751231659-349359282
Opcode ID: dd8fd2d23e8245cc6ce1a9c76ce6c55fe64c057ee0b2979c1b6ed353bf137e3d
Instruction ID: 8f5c917152cd4cd7a20dc966b094444afab0b3208363d98ba125920557097019
Opcode Fuzzy Hash: dd8fd2d23e8245cc6ce1a9c76ce6c55fe64c057ee0b2979c1b6ed353bf137e3d
Instruction Fuzzy Hash: E6418FE1A0DA4284FA54BF71D15ABF957939F90BE8F284030ED4D87B86DE6CE002C601

Function 00007FFB1C52BA50 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 218COMMON

Download Yara Rule

APIs

EVP_PKEY_CTX_new_id.LIBCRYPTO-1_1 ref: 00007FFB1C52BAA6
EVP_PKEY_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C52BB00
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C52BB22
EVP_PKEY_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C52BB2A
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FFB1C52BB37
EVP_PKEY_derive_init.LIBCRYPTO-1_1 ref: 00007FFB1C52BC36
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C52BC62
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C52BC8A
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C52BCB8
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C52BCE8

Strings

..\s\ssl\tls13_enc.c, xrefs: 00007FFB1C52BAD0, 00007FFB1C52BD21, 00007FFB1C52BD99
U, xrefs: 00007FFB1C52BDA7
tls13 , xrefs: 00007FFB1C52BB9E
W, xrefs: 00007FFB1C52BDCD

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X_ctrl$X_free$D_sizeR_put_errorX_new_idY_derive_init
String ID: ..\s\ssl\tls13_enc.c$U$W$tls13
API String ID: 2176224248-2595563013
Opcode ID: 9c4e07cfea1cba534e642ee7305fea0f7c96eae06df3aa46ba8d59cb43c49acd
Instruction ID: 5d60c7a7201c35e69e5d19a90a4cc5195c2ed2003bb6be6d068cb873dbf3ec3a
Opcode Fuzzy Hash: 9c4e07cfea1cba534e642ee7305fea0f7c96eae06df3aa46ba8d59cb43c49acd
Instruction Fuzzy Hash: 5F917FF2B0CA42C2F7609E32E40A7FA6692AF857A4F600131EE4D47A96DF3DD511CB40

Function 00007FFB1C4C1FAA Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB1C4D4D33
EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FFB1C4D4DB4
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FFB1C4D4DED
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FFB1C4D4E03
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FFB1C4D4E27
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FFB1C4D4E4B
EVP_DigestFinal_ex.LIBCRYPTO-1_1 ref: 00007FFB1C4D4E65
EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FFB1C4D4E86
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FFB1C4D4E98
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FFB1C4D4EAE
EVP_DigestFinal_ex.LIBCRYPTO-1_1 ref: 00007FFB1C4D4EC2
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D4EE7
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB1C4D4EF6

Strings

..\s\ssl\s3_enc.c, xrefs: 00007FFB1C4D4D4B, 00007FFB1C4D4F12

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: Digest$Update$Final_exInit_ex$L_cleanseX_freeX_new
String ID: ..\s\ssl\s3_enc.c
API String ID: 3290436633-1839494539
Opcode ID: 5f6e5dfa86e159728dc7e8f45d816bdd418fb768454442e8726e99a898406b80
Instruction ID: bd651a914c6dfb68e43ca705d89e50c3ee72307fc0699678d60dd54949110aad
Opcode Fuzzy Hash: 5f6e5dfa86e159728dc7e8f45d816bdd418fb768454442e8726e99a898406b80
Instruction Fuzzy Hash: E55190F1B1CA4281F754AF32E8493FA6292EB95BA4F606034EE8D87796DF3CD4148701

Function 00007FFB1C4C1064 Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 156COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4EFC25
conf_ssl_name_find.LIBCRYPTO-1_1 ref: 00007FFB1C4EFC54
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4EFC80
ERR_add_error_data.LIBCRYPTO-1_1 ref: 00007FFB1C4EFC97
conf_ssl_get_cmd.LIBCRYPTO-1_1 ref: 00007FFB1C4EFD50
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4EFDE1
ERR_add_error_data.LIBCRYPTO-1_1 ref: 00007FFB1C4EFE21

Strings

..\s\ssl\ssl_mcnf.c, xrefs: 00007FFB1C4EFC0A, 00007FFB1C4EFC65, 00007FFB1C4EFDCC
, cmd=, xrefs: 00007FFB1C4EFDEB
, arg=, xrefs: 00007FFB1C4EFE0B
section=, xrefs: 00007FFB1C4EFDFA
system_default, xrefs: 00007FFB1C4EFC36
), xrefs: 00007FFB1C4EFC6C
name=, xrefs: 00007FFB1C4EFC8D

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error$R_add_error_data$conf_ssl_get_cmdconf_ssl_name_find
String ID: )$, arg=$, cmd=$..\s\ssl\ssl_mcnf.c$name=$section=$system_default
API String ID: 1136227658-3150877160
Opcode ID: 20861c4d83544873fea332be66f83719283c0fc082a395a4c0728e779447a3e3
Instruction ID: 7083a1a72a30e36f6c37285d703e93a10dc074a6bf4af0f5f76dc198c628a130
Opcode Fuzzy Hash: 20861c4d83544873fea332be66f83719283c0fc082a395a4c0728e779447a3e3
Instruction Fuzzy Hash: 7151C2E1A0CE8685FB209B71E4096E963A2FF857A8F644431EE4D47B96EF3CD611C700

Function 00007FFB1C4DDB10 Relevance: 22.8, APIs: 5, Strings: 8, Instructions: 98stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB1C4DDB46
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB1C4DDB77
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DDC2B

Strings

ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFB1C4DDC55, 00007FFB1C4DDC65
SUITEB128ONLY, xrefs: 00007FFB1C4DDB3A
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFB1C4DDC4E
SUITEB128, xrefs: 00007FFB1C4DDB9B
..\s\ssl\ssl_ciph.c, xrefs: 00007FFB1C4DDC0C
SUITEB192, xrefs: 00007FFB1C4DDBC9
SUITEB128C2, xrefs: 00007FFB1C4DDB6A
ECDHE-ECDSA-AES128-GCM-SHA256, xrefs: 00007FFB1C4DDC71

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: strncmp$R_put_error
String ID: ..\s\ssl\ssl_ciph.c$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192
API String ID: 2707563706-2661540032
Opcode ID: 73a2b98f0341162a4e3f0692160103fb4748255efad1c5f3900bd53c3e4ab39e
Instruction ID: 39eab71f504687843a810ed399fa2f933c97756ad53ce8612689c902ee65632e
Opcode Fuzzy Hash: 73a2b98f0341162a4e3f0692160103fb4748255efad1c5f3900bd53c3e4ab39e
Instruction Fuzzy Hash: 4C41C0F2A1CE0696F7149B34E8483B877A2EB59B68F204035DA4DC3690DF6CE660C711

Function 00007FFB1C4C1032 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DA6EC
BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DA6F6
X509_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DA700
OPENSSL_sk_set_cmp_func.LIBCRYPTO-1_1 ref: 00007FFB1C4DA70B
X509_get_subject_name.LIBCRYPTO-1_1 ref: 00007FFB1C4DA75A
X509_NAME_dup.LIBCRYPTO-1_1 ref: 00007FFB1C4DA767
OPENSSL_sk_find.LIBCRYPTO-1_1 ref: 00007FFB1C4DA77E
X509_NAME_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DA78A
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4DA797
PEM_read_bio_X509.LIBCRYPTO-1_1 ref: 00007FFB1C4DA7AE
ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DA7B8
X509_NAME_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DA7C5

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFB1C4DA6D1

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X509_$E_free$E_dupL_sk_findL_sk_pushL_sk_set_cmp_funcM_read_bio_O_freeR_clear_errorR_put_errorX509X509_freeX509_get_subject_name
String ID: ..\s\ssl\ssl_cert.c
API String ID: 2219757170-349359282
Opcode ID: 3377be9ea0c861a8bc9dc3ae1b72f80439e04a90d178a7140446e9f67bf3227b
Instruction ID: d1ae9da331123ffd6e16fdf1f8038978ad8d1b6f8e37125fc993db6ac2aee1d4
Opcode Fuzzy Hash: 3377be9ea0c861a8bc9dc3ae1b72f80439e04a90d178a7140446e9f67bf3227b
Instruction Fuzzy Hash: B63172E1B0DA4281FA54BE32D41A7F913A2AF95BE8F640030ED4D87B86EE2CF515C601

Function 00007FFB1C4EBDE0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4EBED4

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4EBE0C, 00007FFB1C4EBE83, 00007FFB1C4EBFBA, 00007FFB1C4EBFEA, 00007FFB1C4EC06C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: e2010292a798e4b4abf6d4b921dfb37c3f42007b55391f87e3d814cd27a32dfc
Instruction ID: d255ccfaae658d686515f11f9c5f74b7ccdcda7841f44dee3e372c5ab89f801c
Opcode Fuzzy Hash: e2010292a798e4b4abf6d4b921dfb37c3f42007b55391f87e3d814cd27a32dfc
Instruction Fuzzy Hash: 6271A7F2A0CA46C2F7619F61E4097E96792FB407A8F644035DA4C47B85DF3CE691CB04

Function 00007FFB1C514A70 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

X509_STORE_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB1C514B00
X509_STORE_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C514B57
ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FFB1C514B71
X509_STORE_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C514B9C
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C514BB4
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FFB1C514BC6
X509_STORE_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C514BE9
X509_STORE_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C514BF6

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFB1C514B1C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X509_$X_free$L_sk_numL_sk_valueR_clear_errorX_new
String ID: ..\s\ssl\statem\statem_lib.c
API String ID: 2569856840-2839845709
Opcode ID: d2b7cf77216364fd34968b40614bac36d8ff9993649df2127c7faa86ca99ddc0
Instruction ID: e64d12d2374d7dfe414d9a46c8a913b3a1219245b077a9ba03fdd8815b59ba3f
Opcode Fuzzy Hash: d2b7cf77216364fd34968b40614bac36d8ff9993649df2127c7faa86ca99ddc0
Instruction Fuzzy Hash: 7A51A5E1B0CA4281FB609A72D46E7FA5A929F45FE4F686430EE0C57B96DF2CD5028301

Function 00007FFB1C4C1F3C Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4EF9B1
conf_ssl_name_find.LIBCRYPTO-1_1 ref: 00007FFB1C4EF9DA
conf_ssl_get.LIBCRYPTO-1_1 ref: 00007FFB1C4EFA01
conf_ssl_get_cmd.LIBCRYPTO-1_1 ref: 00007FFB1C4EFA86

Strings

..\s\ssl\ssl_mcnf.c, xrefs: 00007FFB1C4EF996, 00007FFB1C4EFAED
, cmd=, xrefs: 00007FFB1C4EFB0F
, arg=, xrefs: 00007FFB1C4EFB2F
!, xrefs: 00007FFB1C4EF99D
section=, xrefs: 00007FFB1C4EFB1E
system_default, xrefs: 00007FFB1C4EF9C6

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_errorconf_ssl_getconf_ssl_get_cmdconf_ssl_name_find
String ID: !$, arg=$, cmd=$..\s\ssl\ssl_mcnf.c$section=$system_default
API String ID: 636194058-1492845798
Opcode ID: 28dd3adbae34ab5565c41964d5cc92b11e5f1c66e75b9862ea9b575fc572cefb
Instruction ID: cedd12f9ebc5326d583fcc6e4f8ed73f5500a7fd3195fb6eafc8dd932473e24b
Opcode Fuzzy Hash: 28dd3adbae34ab5565c41964d5cc92b11e5f1c66e75b9862ea9b575fc572cefb
Instruction Fuzzy Hash: 29417FE2A0CE8295EB609F65E0453E96392FF847A4F604035EE8D47B96DF3CD555C700

Function 00007FFB1C4C1028 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 185COMMON

Download Yara Rule

APIs

EVP_CIPHER_flags.LIBCRYPTO-1_1 ref: 00007FFB1C4DF09E
EVP_get_cipherbyname.LIBCRYPTO-1_1 ref: 00007FFB1C4DF0FD
EVP_get_cipherbyname.LIBCRYPTO-1_1 ref: 00007FFB1C4DF11A
EVP_get_cipherbyname.LIBCRYPTO-1_1 ref: 00007FFB1C4DF13A
EVP_get_cipherbyname.LIBCRYPTO-1_1 ref: 00007FFB1C4DF157
EVP_get_cipherbyname.LIBCRYPTO-1_1 ref: 00007FFB1C4DF177

Strings

AES-128-CBC-HMAC-SHA256, xrefs: 00007FFB1C4DF150
RC4-HMAC-MD5, xrefs: 00007FFB1C4DF0F6
AES-256-CBC-HMAC-SHA1, xrefs: 00007FFB1C4DF133
AES-256-CBC-HMAC-SHA256, xrefs: 00007FFB1C4DF170
AES-128-CBC-HMAC-SHA1, xrefs: 00007FFB1C4DF113

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: P_get_cipherbyname$R_flags
String ID: AES-128-CBC-HMAC-SHA1$AES-128-CBC-HMAC-SHA256$AES-256-CBC-HMAC-SHA1$AES-256-CBC-HMAC-SHA256$RC4-HMAC-MD5
API String ID: 3190984984-741925770
Opcode ID: d4e2236f436467f667db16ff2bf68cd63d0d1110fcfcbd0a542c9c91921d5980
Instruction ID: bd8530692d6ac2fe3f1ef6b5c29c3ac5e83adc8908808e4fe97cf0c018829c52
Opcode Fuzzy Hash: d4e2236f436467f667db16ff2bf68cd63d0d1110fcfcbd0a542c9c91921d5980
Instruction Fuzzy Hash: 46814AF5A0DE0295FA71AF24D5492FD32A2AF28B68F744235D94D82294DF3CE865C601

Function 00007FFB1C51FBE0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 157COMMON

Download Yara Rule

APIs

EVP_PKEY_CTX_new.LIBCRYPTO-1_1(?,?,?,?,?,..\s\ssl\statem\statem_srvr.c,00007FFB1C521C30), ref: 00007FFB1C51FC65
X509_get0_pubkey.LIBCRYPTO-1_1(?,?,?,?,?,..\s\ssl\statem\statem_srvr.c,00007FFB1C521C30), ref: 00007FFB1C51FCD6
ERR_clear_error.LIBCRYPTO-1_1(?,?,?,?,?,..\s\ssl\statem\statem_srvr.c,00007FFB1C521C30), ref: 00007FFB1C51FCEF
ASN1_item_d2i.LIBCRYPTO-1_1(?,?,?,?,?,..\s\ssl\statem\statem_srvr.c,00007FFB1C521C30), ref: 00007FFB1C51FD0E
ASN1_TYPE_get.LIBCRYPTO-1_1(?,?,?,?,?,..\s\ssl\statem\statem_srvr.c,00007FFB1C521C30), ref: 00007FFB1C51FD2B
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1(?,?,?,?,?,..\s\ssl\statem\statem_srvr.c,00007FFB1C521C30), ref: 00007FFB1C51FDDE
EVP_PKEY_CTX_free.LIBCRYPTO-1_1(?,?,?,?,?,..\s\ssl\statem\statem_srvr.c,00007FFB1C521C30), ref: 00007FFB1C51FE34
ASN1_item_free.LIBCRYPTO-1_1(?,?,?,?,?,..\s\ssl\statem\statem_srvr.c,00007FFB1C521C30), ref: 00007FFB1C51FE43

Part of subcall function 00007FFB1C4C1C03: CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FFB1C4D86E9
Part of subcall function 00007FFB1C4C1C03: memset.VCRUNTIME140 ref: 00007FFB1C4D8717
Part of subcall function 00007FFB1C4C1C03: memcpy.VCRUNTIME140 ref: 00007FFB1C4D8753
Part of subcall function 00007FFB1C4C1C03: CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D8776
Part of subcall function 00007FFB1C4C1C03: CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D87DD
Part of subcall function 00007FFB1C4C1C03: CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D8858

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFB1C51FBE5, 00007FFB1C51FC7E, 00007FFB1C51FE14
Q, xrefs: 00007FFB1C51FE04
, xrefs: 00007FFB1C51FC0D

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_clear_free$E_getN1_item_d2iN1_item_freeO_mallocR_clear_errorX509_get0_pubkeyX_ctrlX_freeX_newmemcpymemset
String ID: $..\s\ssl\statem\statem_srvr.c$Q
API String ID: 2622237655-4085857157
Opcode ID: 5b48cafeb39a261de93a6a71aa9f7a2c26bcb20980d5aeb71b2d1c9de30d463b
Instruction ID: c752bbfeca9f5e189f8460aee6ea86a367b34a364231e2270675c54e8e6ea4a9
Opcode Fuzzy Hash: 5b48cafeb39a261de93a6a71aa9f7a2c26bcb20980d5aeb71b2d1c9de30d463b
Instruction Fuzzy Hash: C76180E260CE4281EA609F26E45A3FD63A2EB94BE8F244235DE8D47795DE3CE501C700

Function 00007FFB1C4C203B Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133stringCOMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FFB1C4C7559
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4C7581
strchr.VCRUNTIME140 ref: 00007FFB1C4C75B8
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB1C4C7632
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4C7669
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FFB1C4C7671

Strings

H, xrefs: 00007FFB1C4C756B
..\s\ssl\d1_srtp.c, xrefs: 00007FFB1C4C7573, 00007FFB1C4C7654

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error$L_sk_freeL_sk_new_nullstrchrstrncmp
String ID: ..\s\ssl\d1_srtp.c$H
API String ID: 767303460-1001428523
Opcode ID: fa8373fa23cacea2c3c3af1cf80259226a094c57883efab07b9442bccd6f4d95
Instruction ID: e36b6f061b8640fd90cef34bf2364bb6ef216aecbace078cbb5f036d304437f6
Opcode Fuzzy Hash: fa8373fa23cacea2c3c3af1cf80259226a094c57883efab07b9442bccd6f4d95
Instruction Fuzzy Hash: 0541D3E1B0DA4286FB50DB35E4083FA5692EF45BB8F644431E94D877A2DE3CE552C308

Function 00007FFB1C524F60 Relevance: 18.2, APIs: 12, Instructions: 167COMMON

Download Yara Rule

APIs

OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FFB1C524F93
X509_get0_pubkey.LIBCRYPTO-1_1 ref: 00007FFB1C524FC5
EVP_PKEY_security_bits.LIBCRYPTO-1_1 ref: 00007FFB1C524FD2
X509_get_extension_flags.LIBCRYPTO-1_1 ref: 00007FFB1C525017
X509_get_signature_info.LIBCRYPTO-1_1 ref: 00007FFB1C525043
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C5250A2
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FFB1C5250C5
X509_get0_pubkey.LIBCRYPTO-1_1 ref: 00007FFB1C5250D3
EVP_PKEY_security_bits.LIBCRYPTO-1_1 ref: 00007FFB1C5250E0
X509_get_extension_flags.LIBCRYPTO-1_1 ref: 00007FFB1C52511F
X509_get_signature_info.LIBCRYPTO-1_1 ref: 00007FFB1C52514B
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C5251A6

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: L_sk_numL_sk_valueX509_get0_pubkeyX509_get_extension_flagsX509_get_signature_infoY_security_bits
String ID:
API String ID: 4014977459-0
Opcode ID: 3e4dcf98842d67006d991922aad044cf00ca79e43e0b11b45ea65998ba12cd8f
Instruction ID: 35da3e5ad4a705028c7f628f2a02adddea2239970e604aa60d85d91568eaf999
Opcode Fuzzy Hash: 3e4dcf98842d67006d991922aad044cf00ca79e43e0b11b45ea65998ba12cd8f
Instruction Fuzzy Hash: 655196E2B0CA8286F7749E36E41A7FA52D27F857A8F644431ED8E87796DE3CD4018700

Function 00007FFB1C4C1C08 Relevance: 18.1, APIs: 12, Instructions: 126COMMON

Download Yara Rule

APIs

SCT_LIST_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E8043
d2i_OCSP_RESPONSE.LIBCRYPTO-1_1 ref: 00007FFB1C4E8098
OCSP_response_get1_basic.LIBCRYPTO-1_1 ref: 00007FFB1C4E80A8
OCSP_resp_count.LIBCRYPTO-1_1 ref: 00007FFB1C4E80BA
OCSP_resp_get0.LIBCRYPTO-1_1 ref: 00007FFB1C4E80C8
OCSP_SINGLERESP_get1_ext_d2i.LIBCRYPTO-1_1 ref: 00007FFB1C4E80E0
OCSP_resp_count.LIBCRYPTO-1_1 ref: 00007FFB1C4E8108
SCT_LIST_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E8114
OCSP_BASICRESP_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E811C
OCSP_RESPONSE_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E8124
X509_get_ext_d2i.LIBCRYPTO-1_1 ref: 00007FFB1C4E815F
SCT_LIST_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E8181

Part of subcall function 00007FFB1C4EC5B0: OPENSSL_sk_new_null.LIBCRYPTO-1_1(?,00007FFB1C4E817C), ref: 00007FFB1C4EC5E3
Part of subcall function 00007FFB1C4EC5B0: ERR_put_error.LIBCRYPTO-1_1(?,00007FFB1C4E817C), ref: 00007FFB1C4EC60B

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: T_free$P_resp_count$E_freeL_sk_new_nullP_freeP_get1_ext_d2iP_resp_get0P_response_get1_basicR_put_errorX509_get_ext_d2id2i_
String ID:
API String ID: 2393059476-0
Opcode ID: 2dfece529bd8bd58819162750afd3395d57f5744004cd4cae933da1eb4af8b7a
Instruction ID: 94b70cf2a6d8ce051f6e36299176433ccb77c238bf301492bd4e315159a83f4f
Opcode Fuzzy Hash: 2dfece529bd8bd58819162750afd3395d57f5744004cd4cae933da1eb4af8b7a
Instruction Fuzzy Hash: 87418ED1B0DB4682FE649A7AD85A3FAA7D29F80BE4F240034DE4D47782EF6DE5108700

Function 00007FFB1C4F28C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1(?,?,00000000,00007FFB1C4F14B5), ref: 00007FFB1C4F2906
X509_get0_pubkey.LIBCRYPTO-1_1(00000000,00007FFB1C4F14B5), ref: 00007FFB1C4F292F
ERR_put_error.LIBCRYPTO-1_1(?,?,00000000,00007FFB1C4F14B5), ref: 00007FFB1C4F2954

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFB1C4F28F8, 00007FFB1C4F2939

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error$X509_get0_pubkey
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 2083351937-2723262194
Opcode ID: 66aec5249dce38c4fffc1daf5e6cf42b198f22064bc0e9ab81d5414f3f1cabe4
Instruction ID: 336b39f035db47ee615fc9bd5296b8d467fea1d7a8629b1decb61d49b2ff69e4
Opcode Fuzzy Hash: 66aec5249dce38c4fffc1daf5e6cf42b198f22064bc0e9ab81d5414f3f1cabe4
Instruction Fuzzy Hash: 7B317EA2718D4681EF00DF35E0556EDA3A1FB98B98F640231EA8D4379AEE7CD514C701

Function 00007FFB1C4D6A90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4D6AB2
EVP_PKEY_new.LIBCRYPTO-1_1 ref: 00007FFB1C4D6AC9
EVP_PKEY_set1_DH.LIBCRYPTO-1_1 ref: 00007FFB1C4D6AD7
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D6AE3
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4D6B0A

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFB1C4D6AA8, 00007FFB1C4D6AFC, 00007FFB1C4D6B45

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error$Y_freeY_newY_set1_
String ID: ..\s\ssl\s3_lib.c
API String ID: 520254984-4238427508
Opcode ID: 19025835224e3c7cd399765ce41c34688db47981282eb9bcae590817ce5b4852
Instruction ID: e5d725b7cd3d77a5db6b4e65e139da77d941b737fa6a4937fecd6a8b396f3d6a
Opcode Fuzzy Hash: 19025835224e3c7cd399765ce41c34688db47981282eb9bcae590817ce5b4852
Instruction Fuzzy Hash: 3B214FE1B0C95282F710EF25E4166ED63A1EB84BA8F640431EE8C47B96EF3CD552C705

Function 00007FFB1C4D5F1F Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4D5F43
EVP_PKEY_new.LIBCRYPTO-1_1 ref: 00007FFB1C4D5F4F
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D5F69
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4D5F92

Strings

b, xrefs: 00007FFB1C4D5FC9
..\s\ssl\s3_lib.c, xrefs: 00007FFB1C4D5F32, 00007FFB1C4D5F82, 00007FFB1C4D5FC2

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error$Y_freeY_new
String ID: ..\s\ssl\s3_lib.c$b
API String ID: 1220942454-2522393336
Opcode ID: da6c89c6a2d2f1defefbbde7905c3b838b89785aada983ad7de5105deaf973e6
Instruction ID: eefb8ec68828702944f53019fe8e7a89f798baeb724313f2ba96df2acf005e0c
Opcode Fuzzy Hash: da6c89c6a2d2f1defefbbde7905c3b838b89785aada983ad7de5105deaf973e6
Instruction Fuzzy Hash: 702160E1A0CD4285F720AE71D50A3F95293AB847A8F240436ED4D87B96DE3CE5028712

Function 00007FFB1C4C1AB4 Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FFB1C4D207D
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FFB1C4D2085
EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB1C4D209D
EVP_MD_CTX_copy.LIBCRYPTO-1_1 ref: 00007FFB1C4D20B4
EVP_CIPHER_CTX_cipher.LIBCRYPTO-1_1 ref: 00007FFB1C4D215D
EVP_CIPHER_flags.LIBCRYPTO-1_1 ref: 00007FFB1C4D2165
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FFB1C4D21E3
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FFB1C4D21F7
EVP_DigestSignFinal.LIBCRYPTO-1_1 ref: 00007FFB1C4D220B
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D2217
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D2248

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: Digest$UpdateX_free$D_sizeFinalR_flagsSignX_cipherX_copyX_mdX_new
String ID:
API String ID: 109953546-0
Opcode ID: ed768aeb174077027a9c1cb8ffaf9f7d6aba0938cad668a1e84d772bed191a9e
Instruction ID: aa1559af7a58e67423554ac54e12d6703e78146c131024790437c74b1ec0cb8a
Opcode Fuzzy Hash: ed768aeb174077027a9c1cb8ffaf9f7d6aba0938cad668a1e84d772bed191a9e
Instruction Fuzzy Hash: 6961D2A2A0CF8185EB61AF66D4453F967A1FB55BB8F244031EE8D87751CE3CE821C700

Function 00007FFB1C529F30 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

EVP_MD_size.LIBCRYPTO-1_1(?,?,?,?,?,00000374,00000000,?,00007FFB1C52C0DF), ref: 00007FFB1C529FA1
EVP_CIPHER_flags.LIBCRYPTO-1_1(?,?,?,?,?,00000374,00000000,?,00007FFB1C52C0DF), ref: 00007FFB1C52A009
EVP_CipherInit_ex.LIBCRYPTO-1_1(?,?,?,?,?,00000374,00000000,?,00007FFB1C52C0DF), ref: 00007FFB1C52A134
EVP_CIPHER_CTX_ctrl.LIBCRYPTO-1_1(?,?,?,?,?,00000374,00000000,?,00007FFB1C52C0DF), ref: 00007FFB1C52A14B
EVP_CIPHER_CTX_ctrl.LIBCRYPTO-1_1(?,?,?,?,?,00000374,00000000,?,00007FFB1C52C0DF), ref: 00007FFB1C52A167
OPENSSL_cleanse.LIBCRYPTO-1_1(?,?,?,?,?,00000374,00000000,?,00007FFB1C52C0DF), ref: 00007FFB1C52A1D0

Strings

..\s\ssl\tls13_enc.c, xrefs: 00007FFB1C52A1AB
key, xrefs: 00007FFB1C52A09C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X_ctrl$CipherD_sizeInit_exL_cleanseR_flags
String ID: ..\s\ssl\tls13_enc.c$key
API String ID: 3239367310-4187096943
Opcode ID: d2b4f56a8be8bbcbab3b518e06824074cfda1b1e3d3bd24a03a282a397024637
Instruction ID: d5bce718ac8e42db1133479d8e8ab304079b58efb6b117505c2818528a2180ec
Opcode Fuzzy Hash: d2b4f56a8be8bbcbab3b518e06824074cfda1b1e3d3bd24a03a282a397024637
Instruction Fuzzy Hash: A161A4B2608B8185E7609F22E85A7EAB7E2FB857A4F200135EE8D47B55DF3CD141CB04

Function 00007FFB1C4C1E88 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-1_1 ref: 00007FFB1C4F1B40
BIO_new.LIBCRYPTO-1_1 ref: 00007FFB1C4F1B48
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4F1B75
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F1C0A
X509_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F1C12
BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F1C1A

Strings

D, xrefs: 00007FFB1C4F1BEB
..\s\ssl\ssl_rsa.c, xrefs: 00007FFB1C4F1BF9

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_fileR_put_errorX509_free
String ID: ..\s\ssl\ssl_rsa.c$D
API String ID: 785824201-3596933457
Opcode ID: 7ae34924d183e72bae6bc981890593effe2f20bbc68312bee59d6f61b8f4a4fd
Instruction ID: a4654c432acf1483aa5f0549f46bc9a0fd3974eb81fb02385118d906727d8402
Opcode Fuzzy Hash: 7ae34924d183e72bae6bc981890593effe2f20bbc68312bee59d6f61b8f4a4fd
Instruction Fuzzy Hash: E631F6E1A0CA82C2F7209FA6D4097F95792AF45BE8F240031ED4D1BB96EE3CE411C700

Function 00007FFB1C4C1CF8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-1_1 ref: 00007FFB1C4F176F
BIO_new.LIBCRYPTO-1_1 ref: 00007FFB1C4F1777
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4F17A4
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F183D
BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F1845

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFB1C4F182C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_fileR_put_error
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 2618924202-2723262194
Opcode ID: 0d2a53c5878bf302ea74a3d2c0943278bfc6bf0a7a08a2d738756acb99ee8b43
Instruction ID: e3c585eab883eb56545b7b542cd182ff2000b2f4ca3ab2d4f14c6c246ed29ed1
Opcode Fuzzy Hash: 0d2a53c5878bf302ea74a3d2c0943278bfc6bf0a7a08a2d738756acb99ee8b43
Instruction Fuzzy Hash: F531B3E1E0CA8282F6249F76D5096F97393EB45BA8F244035EE8D07B86DF3DE5118741

Function 00007FFB1C4C1B09 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4DA84B
OPENSSL_sk_new_reserve.LIBCRYPTO-1_1 ref: 00007FFB1C4DA856
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DA87E
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FFB1C4DA8A5
X509_NAME_dup.LIBCRYPTO-1_1 ref: 00007FFB1C4DA8AD
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4DA8BD

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFB1C4DA863, 00007FFB1C4DA8ED

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: E_dupL_sk_new_reserveL_sk_numL_sk_pushL_sk_valueR_put_errorX509_
String ID: ..\s\ssl\ssl_cert.c
API String ID: 2399292771-349359282
Opcode ID: cdbd4194f1c3603256d013f6aedf8007ff1df74b7e66835a6cb7c516b79a1613
Instruction ID: 478b4296d42990f68c829d1e1edadad569c7e36bf689e7405f0a4d9496ad4ead
Opcode Fuzzy Hash: cdbd4194f1c3603256d013f6aedf8007ff1df74b7e66835a6cb7c516b79a1613
Instruction Fuzzy Hash: C921AFE1A0CE4686F750EF75E00A1FA63A2AF44BA4F640531EE4C83B96DE3DE5528700

Function 00007FFB1C4C1A0F Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFB1C4C98C4, 00007FFB1C4C992D, 00007FFB1C4C99A5, 00007FFB1C4C9BC8

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID:
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 0-1306860146
Opcode ID: 2b2580313fd3eda81c191b94ce90e4d042c7fb066b340ef58c78bafb3450914c
Instruction ID: 2ba1ecc87d535f68736b63de75bbc915aebc6bb56053aa4cd8e5d1c849333967
Opcode Fuzzy Hash: 2b2580313fd3eda81c191b94ce90e4d042c7fb066b340ef58c78bafb3450914c
Instruction Fuzzy Hash: 66D1B9B6B08A8296E7208F75E4443ED37A2FB54BACF284135CE4D5B7AADE38D415C704

Function 00007FFB1C4C1AE1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB1C52B06F
EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FFB1C52B0DF
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FFB1C52B0FA
EVP_DigestFinal_ex.LIBCRYPTO-1_1 ref: 00007FFB1C52B117
EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FFB1C52B12D
EVP_DigestFinal_ex.LIBCRYPTO-1_1 ref: 00007FFB1C52B147
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C52B203

Strings

exporter, xrefs: 00007FFB1C52B1AB

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: Digest$Final_exInit_ex$UpdateX_freeX_new
String ID: exporter
API String ID: 3991325671-111224270
Opcode ID: 6db91f6e7a50d29c189a781b5cb2ec7b01beb461c5d0a76148aec2d368d33676
Instruction ID: 0d75052b7e37a586c513773f865f3837899d98221d33994bc6518c6475d1c79b
Opcode Fuzzy Hash: 6db91f6e7a50d29c189a781b5cb2ec7b01beb461c5d0a76148aec2d368d33676
Instruction Fuzzy Hash: BC5152B2608B86C5E7619E65E9453EAA3E6FB88BE4F600031EE8D47B59DF3CD440C704

Function 00007FFB1C4C1F9B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB1C52AE2B
EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FFB1C52AE57
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FFB1C52AE7D
EVP_DigestFinal_ex.LIBCRYPTO-1_1 ref: 00007FFB1C52AE9A
EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FFB1C52AEB0
EVP_DigestFinal_ex.LIBCRYPTO-1_1 ref: 00007FFB1C52AECA
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C52AF7E

Strings

exporter, xrefs: 00007FFB1C52AF2E

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: Digest$Final_exInit_ex$UpdateX_freeX_new
String ID: exporter
API String ID: 3991325671-111224270
Opcode ID: 259d941bd695dd4b4e2810f3f506e346f0399d04cc49b9f333689f2b55cfc682
Instruction ID: de7a500edfc602602e64538b1c49102c758a27ca712b4d4a69b820f843fc862d
Opcode Fuzzy Hash: 259d941bd695dd4b4e2810f3f506e346f0399d04cc49b9f333689f2b55cfc682
Instruction Fuzzy Hash: 364131F6608B8285E6619F66E8466EAB3D6EF897E4F500032EE8D47759DE3CD051CB00

Function 00007FFB1C4C1B4A Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

BIO_method_type.LIBCRYPTO-1_1 ref: 00007FFB1C4EB2C9
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4EB2E2
BIO_up_ref.LIBCRYPTO-1_1 ref: 00007FFB1C4EB2EE
BIO_s_socket.LIBCRYPTO-1_1 ref: 00007FFB1C4EB2F5
BIO_new.LIBCRYPTO-1_1 ref: 00007FFB1C4EB2FD
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4EB325
BIO_int_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4EB349

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4EB30A

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_ctrlO_int_ctrlO_method_typeO_newO_s_socketO_up_refR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 123414506-1080266419
Opcode ID: c42e7bdb5a326671d73f4529114916100e088f2952c8b45a132f33ac8baafed4
Instruction ID: 64e044d7a2efc44e5c4558d0a63a8cf410fec15b5f7b0f847e852a9f93126bca
Opcode Fuzzy Hash: c42e7bdb5a326671d73f4529114916100e088f2952c8b45a132f33ac8baafed4
Instruction Fuzzy Hash: 0211C3E2B0CE4282EA509F35E40A6EE5391AF84BA8F680431EA4C47B96DE2CE5108701

Function 00007FFB1C4C1FAF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4FCE8D
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FFB1C4FCEA9
i2d_OCSP_RESPID.LIBCRYPTO-1_1 ref: 00007FFB1C4FCEE8
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4FCEFA
i2d_X509_EXTENSIONS.LIBCRYPTO-1_1 ref: 00007FFB1C4FCF36
i2d_X509_EXTENSIONS.LIBCRYPTO-1_1 ref: 00007FFB1C4FCF79

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFB1C4FCFD6, 00007FFB1C4FD005

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: i2d_$L_sk_numX509_$L_sk_value
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 917959868-592572767
Opcode ID: 08cdea90494c3a99b31619180e34260c7d5da140bcffa4f6762222a91b912c64
Instruction ID: de69c5a494c3f91e7a4f09add868434f0f3d44f2f694dcf70c36f10cfcb0a677
Opcode Fuzzy Hash: 08cdea90494c3a99b31619180e34260c7d5da140bcffa4f6762222a91b912c64
Instruction Fuzzy Hash: E25182E1B0CA0281FB709B36D4493F993939F81BA8F244031ED0D976D6DE2CE5658719

Function 00007FFB1C4D8B10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

EVP_PKEY_CTX_new_id.LIBCRYPTO-1_1 ref: 00007FFB1C4D8B8E
EVP_PKEY_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D8C95

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFB1C4D8B42, 00007FFB1C4D8B9B, 00007FFB1C4D8C1E, 00007FFB1C4D8C5C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X_freeX_new_id
String ID: ..\s\ssl\s3_lib.c
API String ID: 4103210000-4238427508
Opcode ID: 80e51d13c1b8b8dc0d9917b96833d8ff7e49192d0a54f59b0c69cabfbbb27423
Instruction ID: 2ae4fb34c86f47084653b5de041f7dfce3ed83b04df0ce3ec7de47e59ffcada4
Opcode Fuzzy Hash: 80e51d13c1b8b8dc0d9917b96833d8ff7e49192d0a54f59b0c69cabfbbb27423
Instruction Fuzzy Hash: 524180F1A0CB4286F720AF61F4552F967A2FB847A8F640135EA8C47796DF3DD5118B40

Function 00007FFB1C50A980 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C50A9E6
EVP_PKEY_get0_DH.LIBCRYPTO-1_1 ref: 00007FFB1C50AA1D
DH_get0_key.LIBCRYPTO-1_1 ref: 00007FFB1C50AA54
BN_num_bits.LIBCRYPTO-1_1 ref: 00007FFB1C50AA5E
BN_bn2bin.LIBCRYPTO-1_1 ref: 00007FFB1C50AABE
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C50AAC6

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50A9C8, 00007FFB1C50AA96

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: Y_free$H_get0_keyN_bn2binN_num_bitsY_get0_
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 2719771601-1507966698
Opcode ID: dbbff9e266a44ec2d56f3baaa819dddf948038f010e570d847d439f327ba12b8
Instruction ID: a07d6edf5cfb793ce722997c0c47dc466545ff6a4be8b6a3f7dc9252b07c70b2
Opcode Fuzzy Hash: dbbff9e266a44ec2d56f3baaa819dddf948038f010e570d847d439f327ba12b8
Instruction Fuzzy Hash: E53173E2708E4185F6609B22E8066EA5792EF84BA4F544130ED4D87B96DF7CD551C704

Function 00007FFB1C4C1C76 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-1_1 ref: 00007FFB1C4F062F
BIO_new.LIBCRYPTO-1_1 ref: 00007FFB1C4F0637
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4F0664
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F06FD
BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F0705

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFB1C4F06EC

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_fileR_put_error
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 2618924202-2723262194
Opcode ID: 9e17864362f74a27264c0dc2677ea94fec9ec77425b634b97ebc37a3b4666cef
Instruction ID: 2f68f68dc5806c10d69fd5f4eca84a89383389c937e975e2c1344c5ab09ac83a
Opcode Fuzzy Hash: 9e17864362f74a27264c0dc2677ea94fec9ec77425b634b97ebc37a3b4666cef
Instruction Fuzzy Hash: 903161E1A0CA4286F6249F36D5096FD6392EBC4BA8F244035EE8D0BB86DF3CE5118745

Function 00007FFB1C4EE4F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FFB1C4EE534
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FFB1C4EE53C
EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB1C4EE54F
EVP_MD_CTX_copy_ex.LIBCRYPTO-1_1 ref: 00007FFB1C4EE56C
EVP_DigestFinal_ex.LIBCRYPTO-1_1 ref: 00007FFB1C4EE57E
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4EE5CA

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4EE5A9

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_sizeDigestFinal_exX_copy_exX_freeX_mdX_new
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2082763299-1080266419
Opcode ID: 7e91bb2a01a946d76296d89665445dede241a84950b801476149a778619ca4a7
Instruction ID: b133abf20e1cfbeb9663acb3df0b1d8f3838436e4e24d0bdac559ddc27dcd8cd
Opcode Fuzzy Hash: 7e91bb2a01a946d76296d89665445dede241a84950b801476149a778619ca4a7
Instruction Fuzzy Hash: 2C21A3E1B0CB4281F760AE62F8496FA6792AB44BF8F254030AE4D47785EE3CD151C704

Function 00007FFB1C4C2090 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F2AA3
BIO_s_file.LIBCRYPTO-1_1 ref: 00007FFB1C4F2ACB
BIO_new.LIBCRYPTO-1_1 ref: 00007FFB1C4F2AD3
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F2AFB
X509_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F2C70
BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F2C78

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFB1C4F2AE0

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_freeO_newO_s_fileR_clear_errorR_put_errorX509_free
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 1025733963-2723262194
Opcode ID: e825068a3e339e0c49945696180634b53786bdef44d371d129283a4b48cea6cd
Instruction ID: 3fdb046459b01f98390de42e35a8a8319ed94d60164e2a9bcd19940c6fa9c93b
Opcode Fuzzy Hash: e825068a3e339e0c49945696180634b53786bdef44d371d129283a4b48cea6cd
Instruction Fuzzy Hash: EE1196E2A0CE42C6E614EF76E40A6EA6792BF84BA8F284031FD4C47746DE3CE511C741

Function 00007FFB1C4C1C35 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

ERR_peek_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E86D3

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_peek_error
String ID:
API String ID: 3623038435-0
Opcode ID: e34292531a62f98054bbeae0228a9c991a86f74c726e307d082628f0974ddfa5
Instruction ID: df855d0297a48f0094d31c9f3d8547d9a1e6dda4790c794f4be874c99f49f7df
Opcode Fuzzy Hash: e34292531a62f98054bbeae0228a9c991a86f74c726e307d082628f0974ddfa5
Instruction Fuzzy Hash: 89415FE6E1C94282FB689636C6467B91393EF857A8F291030EE0D876C5DF1CE9A1C704

Function 00007FFB1C4C3B20 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

BIO_get_data.LIBCRYPTO-1_1 ref: 00007FFB1C4C3B6D
BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FFB1C4C3B80
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FFB1C4C3BC5
BIO_set_retry_reason.LIBCRYPTO-1_1 ref: 00007FFB1C4C3C65

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_clear_flagsO_get_dataO_set_flagsO_set_retry_reason
String ID:
API String ID: 3836630899-0
Opcode ID: 0ff97888817304b10477d13d63293b9c292839502774179ae5efa7a95f6503cb
Instruction ID: 91d39212510d44921573aa68d0f76c4e0b1dcfafa2776876233a24fd549c4945
Opcode Fuzzy Hash: 0ff97888817304b10477d13d63293b9c292839502774179ae5efa7a95f6503cb
Instruction Fuzzy Hash: E341E6E2A0CA1282E754AE36D5492FE62A2EF40FE8F244031DD4947B97DE3CE961C345

Function 00007FFB1C4F6DD4 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 314COMMON

Download Yara Rule

APIs

BIO_printf.LIBCRYPTO-1_1 ref: 00007FFB1C4F6DF8

Strings

Max Early Data: %u, xrefs: 00007FFB1C4F6DEE
..\s\ssl\ssl_txt.c, xrefs: 00007FFB1C4F6F83

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_printf
String ID: Max Early Data: %u$..\s\ssl\ssl_txt.c
API String ID: 601296420-2657689586
Opcode ID: 28e32e0e4f404b5a2f8b91d9947a378db2fb67e50f74bac4ed5fba9bfe893e28
Instruction ID: fc55b5c474b8a11309f80669911007516438ce0e1936c601304a49210df8f7f4
Opcode Fuzzy Hash: 28e32e0e4f404b5a2f8b91d9947a378db2fb67e50f74bac4ed5fba9bfe893e28
Instruction Fuzzy Hash: 65117BE2B0CA4286F6509F39E5452F56392DF447A8F284031EE4C87B95EF3DE552CB01

Function 00007FFB1C4C2095 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFB1C4FDF32, 00007FFB1C4FE092, 00007FFB1C4FE165, 00007FFB1C4FE1E6, 00007FFB1C4FE20E, 00007FFB1C4FE23E

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 0-592572767
Opcode ID: 5dfaddf761b2e820e1d5757b7a6d0310c33c878f4f974866ee29dffbe5a97288
Instruction ID: 3ff88d3f2eab175a749ef1a056bfe4e2f860397452aac0ef84f30cd44c6c0cb8
Opcode Fuzzy Hash: 5dfaddf761b2e820e1d5757b7a6d0310c33c878f4f974866ee29dffbe5a97288
Instruction Fuzzy Hash: D491A6F2B0CB4185E7249B25E4482F977A2EB85BE8F144135EA8C17B95DF3CE1A1CB04

Function 00007FFB1C4C1082 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50C840, 00007FFB1C50CA06, 00007FFB1C50CA81

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 0-1507966698
Opcode ID: a2bc8e55d50e8edfe92da6185b4c7d5238458eca7533b60a1f8c7684335a6e23
Instruction ID: a398e72a06efe401a4cc1ed6879a0bc9eccddf9b9b1b127a8b5d6da0287765ff
Opcode Fuzzy Hash: a2bc8e55d50e8edfe92da6185b4c7d5238458eca7533b60a1f8c7684335a6e23
Instruction Fuzzy Hash: 5B7184F2A08F4181EB908B66E4452ED6392EF85BE4F540131EA4D87B99DF7CF491C705

Function 00007FFB1C4C1EC4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C50549A
OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FFB1C5054A9
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C50558C
OCSP_RESPID_free.LIBCRYPTO-1_1 ref: 00007FFB1C5055CD

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFB1C5053E7, 00007FFB1C50546E

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_freeL_sk_new_nullL_sk_pop_freeL_sk_push
String ID: ..\s\ssl\statem\extensions_srvr.c
API String ID: 1097302043-1853348325
Opcode ID: 661d35e2f2ec5bdc610d558632a451e2aa4a4761251b938add3a89fe6b1ae247
Instruction ID: d1e369dfd3d533736bb39ddd541f89e11451c43c3f5cb8b6ebc058324da5ad5d
Opcode Fuzzy Hash: 661d35e2f2ec5bdc610d558632a451e2aa4a4761251b938add3a89fe6b1ae247
Instruction Fuzzy Hash: C171A5F2608E8182EBA48F20D04A2FDB7A2FF84768FA44134EA4D87695DF3DD565D704

Function 00007FFB1C4DDD00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DDD48
memcpy.VCRUNTIME140 ref: 00007FFB1C4DDD67
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4DDDA9
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4DDDD7

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FFB1C4DDD29, 00007FFB1C4DDD92, 00007FFB1C4DDDE8, 00007FFB1C4DDE63
P, xrefs: 00007FFB1C4DDD6C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error$L_sk_pushmemcpy
String ID: ..\s\ssl\ssl_ciph.c$P
API String ID: 96246294-2953004322
Opcode ID: d820dd6721127eadfc9148d245c3035dc8d12e150abd13eb7469ebea2bf5b3df
Instruction ID: db8c456f6e523d2b7c790c9c9ddb22e8237bcd288da4203b38bc91b5ede99bdd
Opcode Fuzzy Hash: d820dd6721127eadfc9148d245c3035dc8d12e150abd13eb7469ebea2bf5b3df
Instruction Fuzzy Hash: 3621B4E1B1C94286FBA09F70E4093FD62A2AF95358F600131E98D8679ADF3CE1148B12

Function 00007FFB1C4C1087 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

OPENSSL_sk_new.LIBCRYPTO-1_1 ref: 00007FFB1C51439C
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C514496
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C5144B9
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FFB1C514569
X509_NAME_free.LIBCRYPTO-1_1 ref: 00007FFB1C514571

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFB1C5143B3, 00007FFB1C514503, 00007FFB1C514540

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: L_sk_pop_free$E_freeL_sk_newL_sk_pushX509_
String ID: ..\s\ssl\statem\statem_lib.c
API String ID: 3595667005-2839845709
Opcode ID: 426ed7199c0b4969c0b3cc62a53a60bd4c576247d37bdaa88875b756ffe91c75
Instruction ID: 5d805b4c7095266488c1e79119754295785beaa15c7eb5f79447d00243922e55
Opcode Fuzzy Hash: 426ed7199c0b4969c0b3cc62a53a60bd4c576247d37bdaa88875b756ffe91c75
Instruction Fuzzy Hash: F251F6F1A0CA81C1EB209F21E05E6FA6A92FB44794F64A130EA8D47A96EF7CD141C700

Function 00007FFB1C51F9D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

EVP_PKEY_free.LIBCRYPTO-1_1(?,?,?,00007FFB1C521AC8), ref: 00007FFB1C51FB57

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFB1C51FA13, 00007FFB1C51FB33

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: Y_free
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 1282063954-348624464
Opcode ID: 68c0e9b243a04dadbfe82956df4532a94e61d46f539b26f40e4f85a6ca85ff55
Instruction ID: dc3872755d2c9a4e0a21be61c7b37417bb66021078a136221f7db5ff37307685
Opcode Fuzzy Hash: 68c0e9b243a04dadbfe82956df4532a94e61d46f539b26f40e4f85a6ca85ff55
Instruction Fuzzy Hash: 73418CF2608B41C6EB209F21E0696ED77A6EB84BE4F644235DA4C07B91DF3CE646C704

Function 00007FFB1C524B50 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

EVP_PKEY_security_bits.LIBCRYPTO-1_1 ref: 00007FFB1C524BB0
DH_new.LIBCRYPTO-1_1 ref: 00007FFB1C524BB7
DH_set0_pqg.LIBCRYPTO-1_1 ref: 00007FFB1C524C67
DH_free.LIBCRYPTO-1_1 ref: 00007FFB1C524C78
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C524C80
DH_free.LIBCRYPTO-1_1 ref: 00007FFB1C524C8A
BN_free.LIBCRYPTO-1_1 ref: 00007FFB1C524C92

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: H_freeN_free$H_newH_set0_pqgY_security_bits
String ID:
API String ID: 3535209601-0
Opcode ID: 666eca1a5089ae268fcc5b947b2a1b077d20ab7f56fa60c0fe6761b4df502270
Instruction ID: 8eb18e5d73e25eacf097919fff797dbcb74ea1d7902a3bd242f0e9a9fe569a62
Opcode Fuzzy Hash: 666eca1a5089ae268fcc5b947b2a1b077d20ab7f56fa60c0fe6761b4df502270
Instruction Fuzzy Hash: 16316BD2A0DE42C5FA54AE39D18B2FD56E29F44BA0F240031EA4D96796DF6CE4428601

Function 00007FFB1C4C2036 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 90COMMON

Download Yara Rule

APIs

OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB1C5234A6

Strings

master secret, xrefs: 00007FFB1C523532
extended master secret, xrefs: 00007FFB1C52347D
, xrefs: 00007FFB1C523539
, xrefs: 00007FFB1C52351A
0, xrefs: 00007FFB1C5234E6

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: L_cleanse
String ID: $ $0$extended master secret$master secret
API String ID: 1040887069-741269486
Opcode ID: 049a9f09fb29a84e18dc6e609895062edc3bcda158aabae534cee4d7f4b5a344
Instruction ID: 963c93545cc3f135fbfd42d6d03988df81a023a0ba5fcaccce444a4aed60ee83
Opcode Fuzzy Hash: 049a9f09fb29a84e18dc6e609895062edc3bcda158aabae534cee4d7f4b5a344
Instruction Fuzzy Hash: A04138B2608B8181E760CF25F84539AB7E9FB887A4F644134EA8C42A6ADF7CD055CB00

Function 00007FFB1C4C18BB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-1_1 ref: 00007FFB1C4F6F6E
BIO_new.LIBCRYPTO-1_1 ref: 00007FFB1C4F6F76
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F6F9E
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4F6FC2
BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F6FD7

Strings

..\s\ssl\ssl_txt.c, xrefs: 00007FFB1C4F6F83

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_fileR_put_error
String ID: ..\s\ssl\ssl_txt.c
API String ID: 2618924202-3774725576
Opcode ID: 8c3bf8b929a781d9ab587b480ed5f72c3f11d58ab3f7369985a05f7e6496d869
Instruction ID: 6d6a5c69f61a3ccab86786fc38fb1c79b6e73f6bf074deae32a3d72750a3d3bc
Opcode Fuzzy Hash: 8c3bf8b929a781d9ab587b480ed5f72c3f11d58ab3f7369985a05f7e6496d869
Instruction Fuzzy Hash: 0201DBE1B1CA4181F610DF75E5092E9A3A2EF44BD4F644030EE4C47B56EE3CD441C701

Function 00007FFB1C524D50 Relevance: 9.1, APIs: 6, Instructions: 110COMMON

Download Yara Rule

APIs

X509_get0_pubkey.LIBCRYPTO-1_1 ref: 00007FFB1C524DA2
EVP_PKEY_security_bits.LIBCRYPTO-1_1 ref: 00007FFB1C524DAF
X509_get0_pubkey.LIBCRYPTO-1_1 ref: 00007FFB1C524DEF
EVP_PKEY_security_bits.LIBCRYPTO-1_1 ref: 00007FFB1C524DFC
X509_get_extension_flags.LIBCRYPTO-1_1 ref: 00007FFB1C524E3F
X509_get_signature_info.LIBCRYPTO-1_1 ref: 00007FFB1C524E6F

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X509_get0_pubkeyY_security_bits$X509_get_extension_flagsX509_get_signature_info
String ID:
API String ID: 3342971904-0
Opcode ID: 1cd048e89e2de122093ad64bb7cc5085a88b51651f905387a27b9412eb85911a
Instruction ID: 09d77adaaeb93e12aca5d5775247ed11ba7cb587eee713e4a6ef810fb1dff224
Opcode Fuzzy Hash: 1cd048e89e2de122093ad64bb7cc5085a88b51651f905387a27b9412eb85911a
Instruction Fuzzy Hash: 364171E1B0CA82C2FB659E72E40A7F959D26F84BA4F648035ED4D47B96DF3CD4118701

Function 00007FFB1C4C1519 Relevance: 9.1, APIs: 6, Instructions: 106COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4E9036
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4E9046
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4E9062
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FFB1C4E9075
OPENSSL_sk_find.LIBCRYPTO-1_1 ref: 00007FFB1C4E9083
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C4E90EB

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: L_sk_num$L_sk_findL_sk_value
String ID:
API String ID: 1561070308-0
Opcode ID: 8637a463ff7971430c3df0906eb581b91858d449aad6a22d54388aa8baac8bb8
Instruction ID: 82b58b29079a6379512b1e73db01abb80e6313afdfae8db2748427f4812493dc
Opcode Fuzzy Hash: 8637a463ff7971430c3df0906eb581b91858d449aad6a22d54388aa8baac8bb8
Instruction Fuzzy Hash: F94114D6B0CAC281EB549A35D4093F967E2AB11BA8F694431DE4D873C5DF3ED651C300

Function 00007FFB1C4D8930 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

EVP_PKEY_new.LIBCRYPTO-1_1 ref: 00007FFB1C4D8965
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D898E
EVP_PKEY_CTX_new_id.LIBCRYPTO-1_1 ref: 00007FFB1C4D89A7
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4D89E3
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D8A02
EVP_PKEY_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4D8A13

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: Y_free$X_ctrlX_freeX_new_idY_new
String ID:
API String ID: 1769623012-0
Opcode ID: 2b1d536c979053f58983daff23d2ff20da37ec03f62e8987387f718437f4246d
Instruction ID: 93226b0bbe49089826ab49a35b5bcb9dcbe9a7f88fff41cfd74bcb8b36fa2e7d
Opcode Fuzzy Hash: 2b1d536c979053f58983daff23d2ff20da37ec03f62e8987387f718437f4246d
Instruction Fuzzy Hash: A02133E2A0DB0281FB54AB39F4563FA66E29F857A4F240034EE8D87796DE3DD4508741

Function 00007FFB1C4C191F Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFB1C50BBDE, 00007FFB1C50BF8D

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 0-1507966698
Opcode ID: 3009479f06a2e01aea04a2f99b660f4ba95e7aa54a532bdc7ef11783525b16d6
Instruction ID: 6e204c4544a5be54b9f354490409150c3a68f455f03e49313b9aa37bc3a5b020
Opcode Fuzzy Hash: 3009479f06a2e01aea04a2f99b660f4ba95e7aa54a532bdc7ef11783525b16d6
Instruction Fuzzy Hash: 73B184E1A0CE4281F7A09E32D4893F96796AF94BA8F284031DE4D97F96DF3CD5518B04

Function 00007FFB1C513FD0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,00007FFB1C516417), ref: 00007FFB1C5140DB
BIO_ctrl.LIBCRYPTO-1_1(?,?,?,?,?,00007FFB1C516417), ref: 00007FFB1C514108

Strings

TLS 1.3, server CertificateVerify, xrefs: 00007FFB1C514071
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFB1C51411E
TLS 1.3, client CertificateVerify, xrefs: 00007FFB1C514049

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_ctrlmemcpy
String ID: ..\s\ssl\statem\statem_lib.c$TLS 1.3, client CertificateVerify$TLS 1.3, server CertificateVerify
API String ID: 2266715306-2608420995
Opcode ID: b4e4fbb8b5846df8f49ad4c599f9aa055dd7482a9c61bcf2b47b29f7064e65bb
Instruction ID: 8ff446fc857ff203f6a6103c5d092d8533c0e50caf5a74330e2c02242d9ed60e
Opcode Fuzzy Hash: b4e4fbb8b5846df8f49ad4c599f9aa055dd7482a9c61bcf2b47b29f7064e65bb
Instruction Fuzzy Hash: DF41C2E2A08E81C6E710CF25D4592FD7B61FB55B94F246131DB8C87691DF2DD590C300

Function 00007FFB1C4C18A2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E6E28
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E6E63

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4E6E09, 00007FFB1C4E6E44, 00007FFB1C4E6EAA

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: f068a64ef1d75d7d58ab19724099c206ebf31e401b33bfdcd42cc8daeb4f218d
Instruction ID: 433d07400f4680b72bbf618ec3105a3aaeb0a015a568f1c178ff2fa6350ecc3d
Opcode Fuzzy Hash: f068a64ef1d75d7d58ab19724099c206ebf31e401b33bfdcd42cc8daeb4f218d
Instruction Fuzzy Hash: 3931BEE2A0CA8582F7608F28E0493E923A2EB457A8F644230EA5C4B7D5DF3DC695C704

Function 00007FFB1C4C18B6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB1C5161AC
EVP_MD_CTX_copy_ex.LIBCRYPTO-1_1 ref: 00007FFB1C516201
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C51623C

Strings

l, xrefs: 00007FFB1C51620F
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFB1C5161CA, 00007FFB1C516217

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X_copy_exX_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c$l
API String ID: 3371474330-3956761411
Opcode ID: e579c3f8ebc5a329a365653db8cf03aa40eabc601230d4601765ca5b86d88d67
Instruction ID: f022247b23cebdf51d83b3f7f34732018252174bbe81a2cc0489a4d1255328a0
Opcode Fuzzy Hash: e579c3f8ebc5a329a365653db8cf03aa40eabc601230d4601765ca5b86d88d67
Instruction Fuzzy Hash: 6111B1F1B09E0185F7A09B31D45A3EE23D2EF84B68F640130ED4C86792EF2CE5958B11

Function 00007FFB1C523E80 Relevance: 7.6, APIs: 5, Instructions: 144COMMON

Download Yara Rule

APIs

EVP_PKEY_get0_EC_KEY.LIBCRYPTO-1_1 ref: 00007FFB1C523FE7
EC_KEY_get0_group.LIBCRYPTO-1_1 ref: 00007FFB1C523FEF
EC_GROUP_get_curve_name.LIBCRYPTO-1_1 ref: 00007FFB1C523FF7

Part of subcall function 00007FFB1C523D30: ERR_pop_to_mark.LIBCRYPTO-1_1 ref: 00007FFB1C523D81

EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FFB1C524041
RSA_size.LIBCRYPTO-1_1 ref: 00007FFB1C524050

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: A_sizeD_sizeP_get_curve_nameR_pop_to_markY_get0_Y_get0_group
String ID:
API String ID: 2524731747-0
Opcode ID: 82169aa798e6d87f1775110429e413482d4da22576736d47f800261c4383d381
Instruction ID: 7a808ed96d31684e7298ee57f44681a51ce884e2c2ab5ed0928db8e6266dd3d5
Opcode Fuzzy Hash: 82169aa798e6d87f1775110429e413482d4da22576736d47f800261c4383d381
Instruction Fuzzy Hash: 405134E1A08E82C5EB649E31D44A1F967F2FB85BA4F640535DE1E4B795DF3CE8818200

Function 00007FFB1C4E1F10 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-1_1 ref: 00007FFB1C4E1F52
BIO_new.LIBCRYPTO-1_1 ref: 00007FFB1C4E1F5A
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4E1F76
DH_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E1FD0
BIO_free.LIBCRYPTO-1_1 ref: 00007FFB1C4E1FD8

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: H_freeO_ctrlO_freeO_newO_s_file
String ID:
API String ID: 1469330667-0
Opcode ID: cfa0ef7a7183a356b3a95c0a564bcfb9f065437aa735ec21970364b83c46130a
Instruction ID: f2a81542485384fe6876216e7e3d78ea42f2d84fa43e8b22bd48a72552e3fa8c
Opcode Fuzzy Hash: cfa0ef7a7183a356b3a95c0a564bcfb9f065437aa735ec21970364b83c46130a
Instruction Fuzzy Hash: 4C2105A260DA5186FA60DEB6D405BF923E2AF44FA4F244131EE4D47B42DF3DE5218780

Function 00007FFB1C527000 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

EVP_PKEY_id.LIBCRYPTO-1_1(?,00007FFB1C5259C2), ref: 00007FFB1C527021
EVP_PKEY_get0_EC_KEY.LIBCRYPTO-1_1(?,00007FFB1C5259C2), ref: 00007FFB1C527034
EC_KEY_get0_group.LIBCRYPTO-1_1(?,00007FFB1C5259C2), ref: 00007FFB1C52703F
EC_GROUP_method_of.LIBCRYPTO-1_1(?,?,?,?,?,?,?,?,?,00007FFB1C5259C2), ref: 00007FFB1C52707C
EC_METHOD_get_field_type.LIBCRYPTO-1_1(?,?,?,?,?,?,?,?,?,00007FFB1C5259C2), ref: 00007FFB1C527084

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: D_get_field_typeP_method_ofY_get0_Y_get0_groupY_id
String ID:
API String ID: 2889995728-0
Opcode ID: d80fa439c68ecb3ddac673b68d4e4249833e0f04ec380450ad93bb9190ccfa37
Instruction ID: 214089518a66ed149445890115190207725fdd0cac66b621621653ee7c8658e5
Opcode Fuzzy Hash: d80fa439c68ecb3ddac673b68d4e4249833e0f04ec380450ad93bb9190ccfa37
Instruction Fuzzy Hash: 8021C4E1E0CA82C2EE54DE32D05A2F893C2EF45BE4F341431EA0D87786CF1DE4948A01

Function 00007FFB1C4C1CEE Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FFB1C4DA208
X509_get_subject_name.LIBCRYPTO-1_1 ref: 00007FFB1C4DA21C
X509_NAME_dup.LIBCRYPTO-1_1 ref: 00007FFB1C4DA224
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4DA23B
X509_NAME_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DA247

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X509_$E_dupE_freeL_sk_new_nullL_sk_pushX509_get_subject_name
String ID:
API String ID: 2231116090-0
Opcode ID: 86fbfbe663cbb4593467edcab7eda5d7eb54d8171ef8967dc71d3e9059377d1f
Instruction ID: a0a72a7e336723f9e580e5994c206567af0bfed4ad7ac43f439462dcf14d8a7e
Opcode Fuzzy Hash: 86fbfbe663cbb4593467edcab7eda5d7eb54d8171ef8967dc71d3e9059377d1f
Instruction Fuzzy Hash: 2A0144D1F0DE4280FE54AA76E55E7F952D2AF547E8F281030ED0DC67C6EE1DD4514601

Function 00007FFB1C4C1EEC Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FFB1C4DA158
X509_get_subject_name.LIBCRYPTO-1_1 ref: 00007FFB1C4DA16C
X509_NAME_dup.LIBCRYPTO-1_1 ref: 00007FFB1C4DA174
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4DA18B
X509_NAME_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DA197

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X509_$E_dupE_freeL_sk_new_nullL_sk_pushX509_get_subject_name
String ID:
API String ID: 2231116090-0
Opcode ID: 80974153989276e99ec99f41fb77222c34946a958f9e69291f2ad6c92c4277b0
Instruction ID: 255eda75df2baf1033659297aa867e8d34055e626403d7e23bb72da666227112
Opcode Fuzzy Hash: 80974153989276e99ec99f41fb77222c34946a958f9e69291f2ad6c92c4277b0
Instruction Fuzzy Hash: F9018FD1F0DE4280FE95EA75E55E3FD22D29F55BE8F280030ED4C8A786EE2CE4918601

Function 00007FFB1C4DAD50 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FFB1C4DAD74
X509_get_subject_name.LIBCRYPTO-1_1 ref: 00007FFB1C4DAD84
X509_NAME_dup.LIBCRYPTO-1_1 ref: 00007FFB1C4DAD8C
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4DAD9F
X509_NAME_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DADAB

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X509_$E_dupE_freeL_sk_new_nullL_sk_pushX509_get_subject_name
String ID:
API String ID: 2231116090-0
Opcode ID: 26971e7fe1d8819abadfcd16e568a05ff901c8d0dc5de3606a909df13dde3953
Instruction ID: dec27915c59a32d99f6aa4f0e6dbbb183077c44a320fb4ee30104a12aab64050
Opcode Fuzzy Hash: 26971e7fe1d8819abadfcd16e568a05ff901c8d0dc5de3606a909df13dde3953
Instruction Fuzzy Hash: 37F06DD1F0DE4280FE95AE75E15E3F952E39F54BE9F284030ED0C86786EE2CE4518202

Function 00007FFB1C4EEA80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4EEACD

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4EEAB0, 00007FFB1C4EEB7D

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 2d2ca9fba8f418746417bcba745be8831865869f7c52e1f29d3caf84396cadfa
Instruction ID: 185f1e024ae3de8c38f31edbaaa6fc693512074a701682c996e28f8d02eb2dfd
Opcode Fuzzy Hash: 2d2ca9fba8f418746417bcba745be8831865869f7c52e1f29d3caf84396cadfa
Instruction Fuzzy Hash: 7C31A0B1A0CB4186E720DF25E4482E977A2FB84BA8F640535EA8D477E9DF3DD561C700

Function 00007FFB1C4DCF94 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-1_1 ref: 00007FFB1C4DD243

Strings

IDEA(128), xrefs: 00007FFB1C4DD019
DSS, xrefs: 00007FFB1C4DCF94
SHA256, xrefs: 00007FFB1C4DD0BF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_snprintf
String ID: DSS$IDEA(128)$SHA256
API String ID: 3142812517-3841199953
Opcode ID: 817eb5373ce51c7a3ddcfbd3aab375d64b8c0b88a2a1972b4e5cfdf87148b3cb
Instruction ID: 9318b967953fa54d2d481f1548d22d7910aeca9f9c1cfb674d199d19e5c8da47
Opcode Fuzzy Hash: 817eb5373ce51c7a3ddcfbd3aab375d64b8c0b88a2a1972b4e5cfdf87148b3cb
Instruction Fuzzy Hash: 0B1184E2C0CE4240F2756A78D48C0F966B2EBA537CF750132DDCD939A48E3CED618212

Function 00007FFB1C4DCFB4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-1_1 ref: 00007FFB1C4DD243

Strings

IDEA(128), xrefs: 00007FFB1C4DD019
SRP, xrefs: 00007FFB1C4DCFB4
SHA256, xrefs: 00007FFB1C4DD0BF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_snprintf
String ID: IDEA(128)$SHA256$SRP
API String ID: 3142812517-1647395391
Opcode ID: 4abc20a67b3acfc0bf35a9b2dcb4f30148cc4e2619da035db418786d4db27e93
Instruction ID: 13da31fb32a06c48043342f4e6e94171d14c6170f98d3f55356ef9b21a10e696
Opcode Fuzzy Hash: 4abc20a67b3acfc0bf35a9b2dcb4f30148cc4e2619da035db418786d4db27e93
Instruction Fuzzy Hash: D81165E2C0CE4241F1756A78D48C0F956B2EBA537CF750132DDCD929A48E3CE9618212

Function 00007FFB1C4DCFAB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-1_1 ref: 00007FFB1C4DD243

Strings

IDEA(128), xrefs: 00007FFB1C4DD019
PSK, xrefs: 00007FFB1C4DCFAB
SHA256, xrefs: 00007FFB1C4DD0BF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_snprintf
String ID: IDEA(128)$PSK$SHA256
API String ID: 3142812517-1637006702
Opcode ID: c93f1f2bb9e6df80881121235ca2c13b5975e7ac864b1674decff7bac79980e1
Instruction ID: 5296e166cb35573e70957168be8c0ae2047127459521fcaea6abf2887867dcd8
Opcode Fuzzy Hash: c93f1f2bb9e6df80881121235ca2c13b5975e7ac864b1674decff7bac79980e1
Instruction Fuzzy Hash: 221184E2C0CE4240F2756A78D48C0F966B2EBA537CF750132DDCD939A48E3CED618212

Function 00007FFB1C4DCFA2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-1_1 ref: 00007FFB1C4DD243

Strings

IDEA(128), xrefs: 00007FFB1C4DD019
ECDSA, xrefs: 00007FFB1C4DCFA2
SHA256, xrefs: 00007FFB1C4DD0BF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_snprintf
String ID: ECDSA$IDEA(128)$SHA256
API String ID: 3142812517-1715931570
Opcode ID: 8c718dd45c35c0f3dbd29ce180d983f2b0f3e8e8888268ebc93bc934c08862e3
Instruction ID: 805c71171ebe8a11a4bd5857c65f2fd99836df34d2f77dabaeb5fb0a881a2eef
Opcode Fuzzy Hash: 8c718dd45c35c0f3dbd29ce180d983f2b0f3e8e8888268ebc93bc934c08862e3
Instruction Fuzzy Hash: C01162E2C0CE4241F2B56A78D48C0F966B2EBA537CF750132DDCD929A48E3CE9618252

Function 00007FFB1C4DCFCF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-1_1 ref: 00007FFB1C4DD243

Strings

IDEA(128), xrefs: 00007FFB1C4DD019
any, xrefs: 00007FFB1C4DCFCF
SHA256, xrefs: 00007FFB1C4DD0BF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_snprintf
String ID: IDEA(128)$SHA256$any
API String ID: 3142812517-1956614738
Opcode ID: 6eabfa57af5221d42afd56f0373f35191da6a892dc926ed41d66eea9296f4577
Instruction ID: 0258286c1292ba95e8766d4b5d8bd256ca1348f0c587cf6e0c953d72bedfe194
Opcode Fuzzy Hash: 6eabfa57af5221d42afd56f0373f35191da6a892dc926ed41d66eea9296f4577
Instruction Fuzzy Hash: 1C1162E2C0CE4241F2756A78D08C1F966B2EBA537CF750132DDCD939A48E3CED618212

Function 00007FFB1C4DCFC6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-1_1 ref: 00007FFB1C4DD243

Strings

IDEA(128), xrefs: 00007FFB1C4DD019
GOST12, xrefs: 00007FFB1C4DCFC6
SHA256, xrefs: 00007FFB1C4DD0BF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_snprintf
String ID: GOST12$IDEA(128)$SHA256
API String ID: 3142812517-3478822438
Opcode ID: 69208d52610169db375aa84b5b96e18feba941dc421b619b19b186c4b62a5d22
Instruction ID: 819f7d56e221625d43a3fa0780babed4388ca29fe4c9b5bfa03eda611b643f8c
Opcode Fuzzy Hash: 69208d52610169db375aa84b5b96e18feba941dc421b619b19b186c4b62a5d22
Instruction Fuzzy Hash: 0F1184E2C0CE4240F2756A78D08C0F966B2EBA537CF750132DDCD939A48E3CED628212

Function 00007FFB1C4DCFBD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-1_1 ref: 00007FFB1C4DD243

Strings

IDEA(128), xrefs: 00007FFB1C4DD019
GOST01, xrefs: 00007FFB1C4DCFBD
SHA256, xrefs: 00007FFB1C4DD0BF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_snprintf
String ID: GOST01$IDEA(128)$SHA256
API String ID: 3142812517-4064199452
Opcode ID: c18868c3799f0b713a9dacd9d2e43d0a73c90c9cb79889d50331d5b8055529b8
Instruction ID: 7392045ecf985530c11825d16a96a23aa5ed9fe50e40a209e635b4c7fe969131
Opcode Fuzzy Hash: c18868c3799f0b713a9dacd9d2e43d0a73c90c9cb79889d50331d5b8055529b8
Instruction Fuzzy Hash: 831162E2C0CE4240F2756A78D08C0F966B2EBA537CF750132DDCD929A48E3CED618212

Function 00007FFB1C4EABE7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

BIO_s_socket.LIBCRYPTO-1_1 ref: 00007FFB1C4EAC1D
BIO_new.LIBCRYPTO-1_1 ref: 00007FFB1C4EAC25
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4EAC4D
BIO_int_ctrl.LIBCRYPTO-1_1 ref: 00007FFB1C4EAC71
BIO_next.LIBCRYPTO-1_1 ref: 00007FFB1C4EAC85
BIO_up_ref.LIBCRYPTO-1_1 ref: 00007FFB1C4EAC98
BIO_next.LIBCRYPTO-1_1 ref: 00007FFB1C4EACAC
BIO_next.LIBCRYPTO-1_1 ref: 00007FFB1C4EACC5
BIO_free_all.LIBCRYPTO-1_1 ref: 00007FFB1C4EACD9

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4EAC32

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_next$O_free_allO_int_ctrlO_newO_s_socketO_up_refR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 3703036260-1080266419
Opcode ID: 36c0345755847cad665b065ed6d1d5e3336bc5c49eb848ebe30992a66be0e1fa
Instruction ID: 4e7c52d82aa7a7177f58a9225cb8ed4ad8d4750cc084423b61d5993d9f74b8f8
Opcode Fuzzy Hash: 36c0345755847cad665b065ed6d1d5e3336bc5c49eb848ebe30992a66be0e1fa
Instruction Fuzzy Hash: 4CF0B1A1A08B4286F750DB35F54A2D967E1DF45B98F644030EA4C43B56EF3DD551CB00

Function 00007FFB1C4C1B54 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F3410
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F344A
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FFB1C4F3452

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFB1C4F33F5, 00007FFB1C4F343C

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error$E_finish
String ID: ..\s\ssl\ssl_sess.c
API String ID: 1409615136-2868363209
Opcode ID: 32d39800e3d7ae24f45e457392969a65311046178ce5a9532f26ddcd99120161
Instruction ID: 75e757c7373a8b611e082f93ce95878f756d20daa5e8d45d976aceff855bbf6b
Opcode Fuzzy Hash: 32d39800e3d7ae24f45e457392969a65311046178ce5a9532f26ddcd99120161
Instruction Fuzzy Hash: 811152E270894696EB54DF35F5062FD63A1EB84798F640030EA4D43796EF3CE565CA04

Function 00007FFB1C4F1900 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F1939
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F1981

Strings

$, xrefs: 00007FFB1C4F196C
..\s\ssl\ssl_rsa.c, xrefs: 00007FFB1C4F191E, 00007FFB1C4F1965

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: $$..\s\ssl\ssl_rsa.c
API String ID: 1767461275-1365392022
Opcode ID: 13812a739760af8b2d5f0fc3f94c9586e55afbf59a0afc8d1267dca5132fd4ff
Instruction ID: fc8890ae5681898caad89105525dfa5f32bca0c861280d99d288bda3685b7bfe
Opcode Fuzzy Hash: 13812a739760af8b2d5f0fc3f94c9586e55afbf59a0afc8d1267dca5132fd4ff
Instruction Fuzzy Hash: D701E1F2B0C84282E760CF75E4097EA63A2FB88398F644534DB4C43B96EE3DD554CA04

Function 00007FFB1C4C1E74 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

d2i_RSAPrivateKey.LIBCRYPTO-1_1 ref: 00007FFB1C4F16C2
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F16EA
RSA_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F170C

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFB1C4F16CF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: A_freePrivateR_put_errord2i_
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 2825407714-2723262194
Opcode ID: ee9488b7420785cfbd179e1c6f1af1a1ae8ad665005ec4faff540f3c755a8e52
Instruction ID: 14982f34c8c5311620751a71622de42ecaf1c77a9666b1a903568f3415a1a23d
Opcode Fuzzy Hash: ee9488b7420785cfbd179e1c6f1af1a1ae8ad665005ec4faff540f3c755a8e52
Instruction Fuzzy Hash: 24F0F9E1B0C90282EB149F75F4452EEA3E2AF847D4F684032EA4C47796EE3CD454C600

Function 00007FFB1C4C199C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

d2i_PrivateKey.LIBCRYPTO-1_1 ref: 00007FFB1C4F0212
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F023A
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FFB1C4F0260

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFB1C4F021F

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: PrivateR_put_errorY_freed2i_
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 107863293-2723262194
Opcode ID: 8bb2d65338257d8f39be2bd7fcdb3b0fe7e7dab04c42b12a477e47b81e72919d
Instruction ID: 92ac6dce99afcfe8f4e86c31f8f13d2974d38bba0e73f8ebd9b4c888616bfed1
Opcode Fuzzy Hash: 8bb2d65338257d8f39be2bd7fcdb3b0fe7e7dab04c42b12a477e47b81e72919d
Instruction Fuzzy Hash: F00162E2B0CA8182E7409B79E5491EEA3A2AF887D8F684431EA4C47796EF3CD554C605

Function 00007FFB1C4C1A55 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

RAND_priv_bytes.LIBCRYPTO-1_1 ref: 00007FFB1C52D01B
BN_bin2bn.LIBCRYPTO-1_1 ref: 00007FFB1C52D030
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FFB1C52D046
SRP_Calc_B.LIBCRYPTO-1_1 ref: 00007FFB1C52D067

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: Calc_D_priv_bytesL_cleanseN_bin2bn
String ID:
API String ID: 4178199679-0
Opcode ID: 21e6e9d0bc319313cf679ad6e6c81319c055f2495f7e1341c1f5235b52d310f7
Instruction ID: b20f78dc0b5d2c34fd71caf7953340707c6f03470369092d535521f797a24390
Opcode Fuzzy Hash: 21e6e9d0bc319313cf679ad6e6c81319c055f2495f7e1341c1f5235b52d310f7
Instruction Fuzzy Hash: A12176E2A18E81C1EB909F75D4593E963E2FF44B98F144035DA4C867A5EF7CE441C741

Function 00007FFB1C4C1BA4 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

BIO_find_type.LIBCRYPTO-1_1 ref: 00007FFB1C4C4B10
BIO_find_type.LIBCRYPTO-1_1 ref: 00007FFB1C4C4B20
BIO_get_data.LIBCRYPTO-1_1 ref: 00007FFB1C4C4B35
BIO_get_data.LIBCRYPTO-1_1 ref: 00007FFB1C4C4B40

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_find_typeO_get_data
String ID:
API String ID: 280995463-0
Opcode ID: e57005427a89ecffe201a8208c5d30d4adc18b3b02a05da0bc580468037d5cb4
Instruction ID: dbac404e112d512227ee16011217abdcfd859a64f60c743eed86093803b5140c
Opcode Fuzzy Hash: e57005427a89ecffe201a8208c5d30d4adc18b3b02a05da0bc580468037d5cb4
Instruction Fuzzy Hash: 450184D1F0DA4281FA549A62E1093B956929F44BE4F2C6030FD4D47BABEE2CE4918718

Function 00007FFB1C4C1005 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

X509_get_subject_name.LIBCRYPTO-1_1 ref: 00007FFB1C4D9FFC
X509_NAME_dup.LIBCRYPTO-1_1 ref: 00007FFB1C4DA004
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FFB1C4DA01B
X509_NAME_free.LIBCRYPTO-1_1 ref: 00007FFB1C4DA027

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X509_$E_dupE_freeL_sk_pushX509_get_subject_name
String ID:
API String ID: 417592659-0
Opcode ID: fa641d09230c2404afeb33982889ad2d3c85d662d167073098051eacd50ccc5d
Instruction ID: 52e6dcae8726109a4c5583dac7c231d8138d4ac53726235280ab29fc200944f9
Opcode Fuzzy Hash: fa641d09230c2404afeb33982889ad2d3c85d662d167073098051eacd50ccc5d
Instruction Fuzzy Hash: AD0144E1F0DE4280FF95AE75E15E3F952E29F547E8F284034EE0C86786ED1CD4918201

Function 00007FFB1C4EEC00 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4EEC1C
EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FFB1C4EEC28
EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FFB1C4EEC43
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FFB1C4EEC5D

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: X_free$DigestInit_exX_new
String ID:
API String ID: 4262507187-0
Opcode ID: 86cf4abcb94965f2620b4481944ce8e37d155d165c93e9fcbe1b7c18a8aab489
Instruction ID: ef72ad4ef683ef11be6c1b47632d472d74708b268db37e55a6ffc9dae549da34
Opcode Fuzzy Hash: 86cf4abcb94965f2620b4481944ce8e37d155d165c93e9fcbe1b7c18a8aab489
Instruction Fuzzy Hash: 71F044E2F1CE0181EB959F76E55A3A863E2DF44BD4F145031EE4C8779ADE2CD4508702

Function 00007FFB1C4C1933 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FFB1C5059B0
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FFB1C5059E7

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFB1C505A8C, 00007FFB1C505ABD

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: L_sk_numL_sk_value
String ID: ..\s\ssl\statem\extensions_srvr.c
API String ID: 557030205-1853348325
Opcode ID: 8e9b217ed8b35ba76f21ca65516630c682874da7c8d80b7670dce5cc2928bd30
Instruction ID: e7909801f074e7f243b3fec19a781379496c4203cfb410c9f4892035e85781a5
Opcode Fuzzy Hash: 8e9b217ed8b35ba76f21ca65516630c682874da7c8d80b7670dce5cc2928bd30
Instruction Fuzzy Hash: 0451E2F2A08F9182E750CB21E48E2AA37A6FB447A8FA54135EE8D47795EE3CD451C704

Function 00007FFB1C4C14DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFB1C4FBC60

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 0-592572767
Opcode ID: 7ed7012511b55a9cc38eef66af5a52a96d1859bfdd900c136bab3eb33978bff1
Instruction ID: 718174c6e3a52915ad90c33e68b255adf7b0a6105d45705844b89470d1781594
Opcode Fuzzy Hash: 7ed7012511b55a9cc38eef66af5a52a96d1859bfdd900c136bab3eb33978bff1
Instruction Fuzzy Hash: AE3193E1B0CA8282FB508B29E4593FE6392FF85BA8F640135DA4D47BD6DE6CD950C704

Function 00007FFB1C4C1C71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E7708
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4E7783

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4E76EB, 00007FFB1C4E7764

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 59a530758c49ee5b4488ee9cf6127c92e851715d54444b21f381d127822d1818
Instruction ID: b2e564d1ead2e694153ce6f298e7eab0a7140ccfa053bf89d3dc21eb99093ba3
Opcode Fuzzy Hash: 59a530758c49ee5b4488ee9cf6127c92e851715d54444b21f381d127822d1818
Instruction Fuzzy Hash: 29213BF6A18A4282FB90DB72D4097E92392EF84768F698431DA0C87795EF3DE651C610

Function 00007FFB1C4EF050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1(?,00007FFB1C4EB426), ref: 00007FFB1C4EF140

Strings

(, xrefs: 00007FFB1C4EF0A3
..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4EF128

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ($..\s\ssl\ssl_lib.c
API String ID: 1767461275-1617307452
Opcode ID: f14408eb9ca195562ea6dec7abc20826877f6a3aceaca4a2944e49cc10456e41
Instruction ID: de419fd6b6d89856f0df57050cfc37c1adc85dc7454a6d4d7d3c0257e9241ed7
Opcode Fuzzy Hash: f14408eb9ca195562ea6dec7abc20826877f6a3aceaca4a2944e49cc10456e41
Instruction Fuzzy Hash: A0214FF260CE4185F7209F64E4083E9A7A1EB497A8F290235EA8C47799DF7DDA518704

Function 00007FFB1C4EE8B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FFB1C4E9D59), ref: 00007FFB1C4EE8FD

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4EE8E0

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 673b703800c7882b0e722f67f01c3f62ce09d3641cef9abc3e46cbf8675e19c1
Instruction ID: e3a807d029afb47b9c3cb8bfc1b7298f6a64b5f8a80529f26b6071245a886dd0
Opcode Fuzzy Hash: 673b703800c7882b0e722f67f01c3f62ce09d3641cef9abc3e46cbf8675e19c1
Instruction Fuzzy Hash: 0A214FB2A0CF4181E7608F25E4482A977A1FB88BA8F240135EE8D47799DF3CD555C640

Function 00007FFB1C4DCF9D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-1_1 ref: 00007FFB1C4DD243

Strings

IDEA(128), xrefs: 00007FFB1C4DD019
SHA256, xrefs: 00007FFB1C4DD0BF

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_snprintf
String ID: IDEA(128)$SHA256
API String ID: 3142812517-2727354722
Opcode ID: 548a3971ebc6cb1fbcfe044910ebb059dd7f8ed743bcf3a0ca85f29f7f210c10
Instruction ID: 883bc198342f5147d72351e701fa1f2ce54c92a89cc4ffc632896f64e3bdc6c5
Opcode Fuzzy Hash: 548a3971ebc6cb1fbcfe044910ebb059dd7f8ed743bcf3a0ca85f29f7f210c10
Instruction Fuzzy Hash: 681184E2C0CE4240F1756A78D08C0F956B2EBA537CF750132DDCD939A48E3CE9618252

Function 00007FFB1C4C18A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4C7256
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4C7288

Strings

..\s\ssl\d1_msg.c, xrefs: 00007FFB1C4C7246, 00007FFB1C4C7278

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\d1_msg.c
API String ID: 1767461275-424620239
Opcode ID: 4e521ffca490925d0e2cc760b086a1d80451240f88daac4d76c1b0db1793910e
Instruction ID: bffc4774402189b669da95fa030e1c3ca1f4ebdddcc51c45532dce8ceae97413
Opcode Fuzzy Hash: 4e521ffca490925d0e2cc760b086a1d80451240f88daac4d76c1b0db1793910e
Instruction Fuzzy Hash: 6F1121E1A0CA4682F320DB65E8052E97356AF85BB8F644131FE9D477EADE3CD5608708

Function 00007FFB1C4EA010 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4EA05D
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4EA094

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFB1C4EA03E, 00007FFB1C4EA075

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 985734c5465653e849d91668b84320e30a26c8c2d4175ba4fc7219c1b93c32d8
Instruction ID: 7be8fc580df1c1df8598928aa16d9f9d75a355b7a4c870557e7b0a29e02f8a11
Opcode Fuzzy Hash: 985734c5465653e849d91668b84320e30a26c8c2d4175ba4fc7219c1b93c32d8
Instruction Fuzzy Hash: A10175F1B08A4586F7549F64C80A3D92BA1FB40768F648134D64C477D1CF7DD696CB01

Function 00007FFB1C4C6FA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FFB1C4C6FC6
SystemTimeToFileTime.KERNEL32 ref: 00007FFB1C4C6FD6

Strings

gfff, xrefs: 00007FFB1C4C700A

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: 7442baccc76789a6a6f567f819d17292e53452a63d1f4dcb166e9a9b4dce984f
Instruction ID: 1ff4ae94447e8b461b4db7fc11ecdb518b79de3f3bd913999bf91f70e7903eb6
Opcode Fuzzy Hash: 7442baccc76789a6a6f567f819d17292e53452a63d1f4dcb166e9a9b4dce984f
Instruction Fuzzy Hash: 1C012BE2B18D4542DF60DF75F80519867D1EBCC794B549031EA8DC7766EE2CD105C700

Function 00007FFB1C50908A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FFB1C5090FC
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FFB1C509109

Strings

&, xrefs: 00007FFB1C50908F

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: &
API String ID: 3946675294-1010288
Opcode ID: 72a02b1da16f83b1a66852e2e17b5b97c0996bc2e7375db40cfa2179e0ec7348
Instruction ID: b81456b534e40120aa92a3c4c392e8ed6b2b3b277ec279e712a34a96aa9f9314
Opcode Fuzzy Hash: 72a02b1da16f83b1a66852e2e17b5b97c0996bc2e7375db40cfa2179e0ec7348
Instruction Fuzzy Hash: A0F062E2B0894181EB80DF25E0493BD23A2EB85BA8F284034CE4C4B78ADE3ED4918741

Function 00007FFB1C4C1CFD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4F3DEE
memcpy.VCRUNTIME140 ref: 00007FFB1C4F3E10

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFB1C4F3DE0

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_errormemcpy
String ID: ..\s\ssl\ssl_sess.c
API String ID: 1385177007-2868363209
Opcode ID: 2c43a0febf413bf68e2963dff9962abf5f9ee7b87f24c52525cc2617dcf9aa0a
Instruction ID: ed017b59e0778c5b69e79fc248c4a8697ee0a5ab4eab7cb7b8392bbe52fa60ea
Opcode Fuzzy Hash: 2c43a0febf413bf68e2963dff9962abf5f9ee7b87f24c52525cc2617dcf9aa0a
Instruction Fuzzy Hash: BBF0A7E5F2845683F760AB74D40E7EC13A19F40754FA00030E20C46691DE2D9666CB14

Function 00007FFB1C4D6013 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FFB1C4D6030

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFB1C4D6020
m, xrefs: 00007FFB1C4D6018

Memory Dump Source

Source File: 00000002.00000002.1364545934.00007FFB1C4C1000.00000020.00000001.01000000.00000011.sdmp, Offset: 00007FFB1C4C0000, based on PE: true

Associated: 00000002.00000002.1364485212.00007FFB1C4C0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364545934.00007FFB1C533000.00000020.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364652112.00007FFB1C535000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364716083.00007FFB1C558000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C55D000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C563000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000002.00000002.1364735913.00007FFB1C56A000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb1c4c0000_file.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\s3_lib.c$m
API String ID: 1767461275-297842231
Opcode ID: 2bb9ac000ccac7049882de5256a95ee7a062a42c9774bf7a4fa4fbe5cafcabfc
Instruction ID: f6029346e900e04afbfb0951ab15c8827da882ad90b91ea7d24910506b6a85b8
Opcode Fuzzy Hash: 2bb9ac000ccac7049882de5256a95ee7a062a42c9774bf7a4fa4fbe5cafcabfc
Instruction Fuzzy Hash: 61D012A6B0CD45C6F311EF65F4052E96362F784364F540832EF4842696DB3DE597DA10

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_ARC4.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_Salsa20.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_chacha20.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_aes.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_aesni.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_arc2.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_blowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cast.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cbc.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_cfb.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ctr.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_des.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_des3.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ecb.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_eksblowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ocb.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Cipher\_raw_ofb.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_BLAKE2b.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_BLAKE2s.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD2.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD4.pyd

C:\Users\user\AppData\Local\Temp\_MEI58402\Cryptodome\Hash\_MD5.pyd

Windows Analysis Report
file.exe