Edit tour

Windows Analysis Report
lz4wnSavmK.exe

Overview

General Information

Sample name:	lz4wnSavmK.exe renamed because original name is a hash value
Original sample name:	751a7a40b57d187a0b51d92c550e1309.exe
Analysis ID:	1570262
MD5:	751a7a40b57d187a0b51d92c550e1309
SHA1:	70e2bea90cf8571b803d18cfaf3bbe671f4de515
SHA256:	fdbefb2cfbcddbae6f870be9c5bf65266f8775e61422b24bbab0bf36555139ff
Tags:	exeuser-abuse_ch
Infos:

Detection

Python Stealer

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Generic Python Stealer

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

lz4wnSavmK.exe (PID: 7252 cmdline: "C:\Users\user\Desktop\lz4wnSavmK.exe" MD5: 751A7A40B57D187A0B51D92C550E1309)

lz4wnSavmK.exe (PID: 7300 cmdline: "C:\Users\user\Desktop\lz4wnSavmK.exe" MD5: 751A7A40B57D187A0B51D92C550E1309)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: lz4wnSavmK.exe PID: 7300	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: lz4wnSavmK.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B1EE2 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013B1EE2
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B231F ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free,	1_2_00007FFE013B231F
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013F58F0 CRYPTO_free,	1_2_00007FFE013F58F0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B1087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	1_2_00007FFE013B1087
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013F3C30 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	1_2_00007FFE013F3C30
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE01413A90 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	1_2_00007FFE01413A90
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013C1AA0 CRYPTO_free,CRYPTO_strndup,	1_2_00007FFE013C1AA0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013BFB00 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_derive_set_peer,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,	1_2_00007FFE013BFB00
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013FFB00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE013FFB00
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013E3B10 CRYPTO_malloc,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,ERR_set_debug,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE013E3B10
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B12D0 CRYPTO_THREAD_run_once,	1_2_00007FFE013B12D0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013BFDB0 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,	1_2_00007FFE013BFDB0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013C9D50 CRYPTO_free,CRYPTO_strdup,	1_2_00007FFE013C9D50
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B176C CRYPTO_malloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	1_2_00007FFE013B176C
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013DDDC0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	1_2_00007FFE013DDDC0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B11E0 EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	1_2_00007FFE013B11E0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B108C ERR_new,ERR_set_debug,CRYPTO_free,	1_2_00007FFE013B108C
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE01407DE0 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	1_2_00007FFE01407DE0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B25EF CRYPTO_malloc,ERR_new,ERR_set_debug,memmove,ERR_new,ERR_set_debug,	1_2_00007FFE013B25EF
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013D5DE0 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	1_2_00007FFE013D5DE0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B157D CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	1_2_00007FFE013B157D
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013C7CB0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	1_2_00007FFE013C7CB0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE0140FCC0 CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE0140FCC0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B2536 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE013B2536
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B144C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memmove,memmove,	1_2_00007FFE013B144C
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013D5F90 CRYPTO_free,CRYPTO_free,	1_2_00007FFE013D5F90
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B1D8E CRYPTO_free,CRYPTO_memdup,	1_2_00007FFE013B1D8E
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B1B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	1_2_00007FFE013B1B31
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE0140FF50 CRYPTO_free,CRYPTO_strndup,	1_2_00007FFE0140FF50
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013B1ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memmove,memmove,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memmove,ERR_new,memmove,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	1_2_00007FFE013B1ACD

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Jump to behavior

Source: lz4wnSavmK.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: lz4wnSavmK.exe, 00000001.00000002.1788703663.00007FFDFB684000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: cryptography_rust.pdbc source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: lz4wnSavmK.exe, 00000001.00000002.1787982916.00007FFDFB122000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: lz4wnSavmK.exe, 00000001.00000002.1787982916.00007FFDFB122000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794842353.00007FFE120C6000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\engine\tb_digest.cENGINE_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: lz4wnSavmK.exe, 00000000.00000003.1684434492.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1795550062.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: lz4wnSavmK.exe, 00000000.00000003.1684434492.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1795550062.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: lz4wnSavmK.exe, 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: lz4wnSavmK.exe, 00000001.00000002.1791049944.00007FFE012F1000.00000002.00000001.01000000.00000027.sdmp, pywintypes312.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: lz4wnSavmK.exe, 00000001.00000002.1791049944.00007FFE012F1000.00000002.00000001.01000000.00000027.sdmp, pywintypes312.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: lz4wnSavmK.exe, 00000000.00000003.1684544808.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794092458.00007FFE11075000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: lz4wnSavmK.exe, 00000000.00000003.1698076537.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1795257794.00007FFE13203000.00000002.00000001.01000000.0000000E.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: lz4wnSavmK.exe, 00000001.00000002.1795361278.00007FFE13221000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794312623.00007FFE11507000.00000002.00000001.01000000.0000000B.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: lz4wnSavmK.exe, 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794421790.00007FFE1153C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1793742340.00007FFE101D8000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794204498.00007FFE110F2000.00000002.00000001.01000000.00000023.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: lz4wnSavmK.exe, 00000001.00000002.1793861068.00007FFE10252000.00000002.00000001.01000000.00000010.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1795054356.00007FFE12E13000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794421790.00007FFE1153C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794952052.00007FFE126CD000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1795157387.00007FFE130C4000.00000002.00000001.01000000.0000000F.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb!! source: lz4wnSavmK.exe, 00000001.00000002.1791188852.00007FFE01323000.00000002.00000001.01000000.00000026.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb source: lz4wnSavmK.exe, 00000001.00000002.1791188852.00007FFE01323000.00000002.00000001.01000000.00000026.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1793983444.00007FFE10309000.00000002.00000001.01000000.0000000D.sdmp, _socket.pyd.0.dr
Source:	Binary string: cryptography_rust.pdb source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1795157387.00007FFE130C4000.00000002.00000001.01000000.0000000F.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: lz4wnSavmK.exe, 00000001.00000002.1793465071.00007FFE0EB2F000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779477181.0000023D1BF70000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: lz4wnSavmK.exe, 00000000.00000003.1684544808.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794092458.00007FFE11075000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: lz4wnSavmK.exe, 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: lz4wnSavmK.exe, 00000001.00000002.1793578231.00007FFE0EB4D000.00000002.00000001.01000000.00000012.sdmp, _ssl.pyd.0.dr

Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C6392F0 FindFirstFileExW,FindClose,	0_2_00007FF77C6392F0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C6383B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF77C6383B0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C6518E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF77C6518E4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C6392F0 FindFirstFileExW,FindClose,	1_2_00007FF77C6392F0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C6518E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF77C6518E4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C6383B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF77C6383B0

Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.242.208
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.242.208
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.242.208
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.242.208
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.242.208
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.242.208
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.242.208
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.242.208
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.242.208
Source: unknown	TCP traffic detected without corresponding DNS query: 163.5.242.208

Source: global traffic	HTTP traffic detected: GET /qweqwe_token.txt HTTP/1.1Host: 163.5.242.208User-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflateAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /5626872516_chatid.txt HTTP/1.1Host: 163.5.242.208User-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflateAccept: /Connection: keep-alive

Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: - https://www.facebook.com/groups/ equals www.facebook.com (Facebook)
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: d- https://www.facebook.com/groups/ equals www.facebook.com (Facebook)

Source: lz4wnSavmK.exe, 00000001.00000002.1781339387.0000023D1EE10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: lz4wnSavmK.exe, 00000001.00000002.1784295979.0000023D20080000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781084199.0000023D1E9F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://163.5.242.208/5626872516_chatid.txt
Source: lz4wnSavmK.exe, 00000001.00000002.1781084199.0000023D1E9F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://163.5.242.208/5626872516_chatid.txtsl-modulesd
Source: lz4wnSavmK.exe, 00000001.00000002.1785350801.0000023D20210000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781084199.0000023D1E9F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://163.5.242.208/qweqwe_token.txt
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1FB000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1782074997.0000023D1F3FD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.coY
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686830794.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: lz4wnSavmK.exe, 00000001.00000003.1717792025.0000023D1E32C000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1716706926.0000023D1E32C000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E327000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1720252703.0000023D1E327000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722484250.0000023D1E327000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1719678017.0000023D1E52F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: lz4wnSavmK.exe, 00000001.00000003.1715669459.0000023D1E404000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1715669459.0000023D1E3B5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1717190054.0000023D1E40E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1723480325.0000023D1DEAA000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722821384.0000023D1DE8B000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1717592828.0000023D1DEB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: lz4wnSavmK.exe, 00000001.00000002.1779810317.0000023D1DC40000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E4A2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlZ
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlK
Source: lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686830794.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: _hashlib.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1FB000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F331000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1783100518.0000023D1F870000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1FB000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F070000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1783388416.0000023D1FA00000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1783857686.0000023D1FE80000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781339387.0000023D1EE10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: lz4wnSavmK.exe, 00000001.00000002.1781339387.0000023D1EE10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: lz4wnSavmK.exe, 00000001.00000002.1781277030.0000023D1ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: lz4wnSavmK.exe, 00000001.00000003.1717572102.0000023D1DF45000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1718708610.0000023D1DF45000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780951794.0000023D1E7D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: lz4wnSavmK.exe, 00000001.00000003.1717256810.0000023D1DF5C000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780951794.0000023D1E7D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: lz4wnSavmK.exe, 00000001.00000003.1717256810.0000023D1DF5C000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780951794.0000023D1E7D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: lz4wnSavmK.exe, 00000001.00000002.1783388416.0000023D1FA00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl.
Source: lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: lz4wnSavmK.exe, 00000001.00000003.1722653466.0000023D1E5E3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E5E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/post
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: lz4wnSavmK.exe, 00000001.00000002.1783388416.0000023D1FA00000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686830794.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: lz4wnSavmK.exe, 00000001.00000003.1712464663.0000023D1E2D0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780889027.0000023D1E6B0000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780284238.0000023D1E180000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: lz4wnSavmK.exe, 00000001.00000002.1781407808.0000023D1EF60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org
Source: lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org/
Source: lz4wnSavmK.exe, 00000001.00000002.1781407808.0000023D1EF60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org:80
Source: lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E5E3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: lz4wnSavmK.exe, 00000001.00000002.1782074997.0000023D1F3FD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: lz4wnSavmK.exe, 00000001.00000002.1783857686.0000023D1FE80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: lz4wnSavmK.exe, 00000001.00000002.1782074997.0000023D1F3FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: lz4wnSavmK.exe, 00000001.00000002.1781339387.0000023D1EE10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F38B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlcb
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: lz4wnSavmK.exe, 00000000.00000003.1698242863.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: lz4wnSavmK.exe, 00000000.00000003.1700057587.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1698242863.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1698242863.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: lz4wnSavmK.exe, 00000001.00000002.1780889027.0000023D1E6B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E5F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/y
Source: lz4wnSavmK.exe, 00000001.00000002.1782074997.0000023D1F3FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1696189104.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783C3000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783BD000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1692936777.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: lz4wnSavmK.exe, 00000001.00000003.1720553120.0000023D1E3F6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722484250.0000023D1E3F6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E3F6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1718445479.0000023D1E3F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F38B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E3A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E5F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://127.0.0
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781407808.0000023D1EF60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://127.0.0.1:8443
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/user
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_token
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.hypixel.net/player?key=aa5d84c7-f617-4069-9e64-ae177cd7b869&uuid=
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.namemc.com/profile/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetOwnedGames/v0001/?key=440D7F4D810EF9298D25EDDF37C1F90
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://battle.net
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1783388416.0000023D1FA00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue37179
Source: lz4wnSavmK.exe, 00000001.00000002.1781084199.0000023D1E9F0000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781015744.0000023D1E8D0000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1719678017.0000023D1E4A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://catbox.moe/user/api.php
Source: lz4wnSavmK.exe, lz4wnSavmK.exe, 00000001.00000002.1790535718.00007FFE002BC000.00000002.00000001.01000000.0000002A.sdmp	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crafatar.com/skins/
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781407808.0000023D1EF60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.3
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/users/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/guilds/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/users/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/
Source: lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1783388416.0000023D1FA00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
Source: lz4wnSavmK.exe, 00000001.00000003.1713760386.0000023D1E03A000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722821384.0000023D1DF3D000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1712804975.0000023D1E03A000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1714144801.0000023D1E039000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1714798755.0000023D1E039000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1716248069.0000023D1E039000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710604007.0000023D1E052000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1712247311.0000023D1E03A000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1711581460.0000023D1E04C000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1717256810.0000023D1E036000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1718708610.0000023D1E004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F070000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1783388416.0000023D1FA00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
Source: lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779614953.0000023D1D8F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779614953.0000023D1D96C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779614953.0000023D1D96C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779614953.0000023D1D96C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779614953.0000023D1D96C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: lz4wnSavmK.exe, 00000001.00000002.1779734852.0000023D1DB40000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: lz4wnSavmK.exe, 00000001.00000002.1779734852.0000023D1DB40000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779614953.0000023D1D96C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: lz4wnSavmK.exe, 00000001.00000003.1708416694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1708780612.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710995990.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1709094694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779502514.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1720252703.0000023D1E300000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722484250.0000023D1E2F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ebay.com
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://epicgames.com
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://file.io/
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://filepreviews.io/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://friends.roblox.com/v1/users/
Source: lz4wnSavmK.exe, 00000001.00000002.1780951794.0000023D1E7D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1723458510.0000023D1E685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: lz4wnSavmK.exe, 00000001.00000002.1779810317.0000023D1DC40000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1708416694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1708780612.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710995990.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1709094694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779502514.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1783388416.0000023D1FA00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/astral-sh/ruff
Source: lz4wnSavmK.exe, 00000001.00000002.1783857686.0000023D1FE80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: lz4wnSavmK.exe, 00000001.00000002.1780951794.0000023D1E7D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: lz4wnSavmK.exe, lz4wnSavmK.exe, 00000001.00000002.1791231645.00007FFE01331000.00000002.00000001.01000000.00000026.sdmp, lz4wnSavmK.exe, 00000001.00000002.1791115156.00007FFE01302000.00000002.00000001.01000000.00000027.sdmp, win32api.pyd.0.dr, pywintypes312.dll.0.dr	String found in binary or memory: https://github.com/mhammond/pywin32
Source: lz4wnSavmK.exe, 00000001.00000002.1780951794.0000023D1E7D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: lz4wnSavmK.exe, 00000001.00000002.1781407808.0000023D1EF60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: lz4wnSavmK.exe, 00000000.00000003.1700587052.000001A0783B9000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
Source: lz4wnSavmK.exe, 00000001.00000002.1780889027.0000023D1E6B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: lz4wnSavmK.exe, 00000001.00000002.1781149147.0000023D1EAF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: lz4wnSavmK.exe, 00000001.00000002.1781015744.0000023D1E8D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: lz4wnSavmK.exe, 00000001.00000002.1781084199.0000023D1E9F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml
Source: lz4wnSavmK.exe, 00000000.00000003.1700587052.000001A0783B9000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://github.com/pypa/wheel
Source: lz4wnSavmK.exe, 00000000.00000003.1700587052.000001A0783B9000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://github.com/pypa/wheel/issues
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs)
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1328)
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1329)
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1330)
Source: lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/136
Source: lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/251
Source: lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/428
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
Source: lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779614953.0000023D1D96C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: lz4wnSavmK.exe, 00000001.00000002.1779502514.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: lz4wnSavmK.exe, 00000001.00000002.1779810317.0000023D1DC40000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1708416694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1708780612.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710995990.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1709094694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779502514.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: lz4wnSavmK.exe, 00000001.00000003.1714144801.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1718708610.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1711640674.0000023D1DEBB000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722821384.0000023D1DF3D000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1717256810.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1713760386.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1715779434.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1712146990.0000023D1E310000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1711302743.0000023D1E310000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1713115040.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: lz4wnSavmK.exe, 00000001.00000002.1783100518.0000023D1F870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/118960
Source: lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1783388416.0000023D1FA00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/28073
Source: METADATA.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/sponsors/hynek
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/sponsors/hynek).
Source: lz4wnSavmK.exe, 00000001.00000002.1779810317.0000023D1DC40000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1708416694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1708780612.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710995990.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1709094694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779502514.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E5F9000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: lz4wnSavmK.exe, 00000001.00000002.1781277030.0000023D1ECF0000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1723458510.0000023D1E685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: lz4wnSavmK.exe, 00000001.00000002.1781339387.0000023D1EE10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779810317.0000023D1DC68000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722653466.0000023D1E572000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1723458510.0000023D1E685000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722484250.0000023D1E2F8000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722653466.0000023D1E572000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722484250.0000023D1E2F8000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E4A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gql.twitch.tv/gql
Source: lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E5F9000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E5F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: lz4wnSavmK.exe, 00000001.00000003.1723458510.0000023D1E685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: lz4wnSavmK.exe, 00000001.00000002.1781339387.0000023D1EE10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://hynek.me/articles/import-attrs/)
Source: lz4wnSavmK.exe, 00000001.00000002.1781149147.0000023D1EAF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=true
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/users/
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: METADATA.0.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: lz4wnSavmK.exe, 00000001.00000002.1780889027.0000023D1E6B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://inventory.roblox.com/v1/users/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/json
Source: lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://klaviyo.com/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://krakenfiles.com/api/v1/file/upload
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://leagueoflegends.com
Source: lz4wnSavmK.exe, 00000001.00000003.1717792025.0000023D1E2BA000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1717230741.0000023D1E3D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: lz4wnSavmK.exe, 00000001.00000002.1782074997.0000023D1F3FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST
Source: lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/me
Source: lz4wnSavmK.exe, 00000001.00000002.1781149147.0000023D1EAF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: lz4wnSavmK.exe, 00000001.00000002.1781149147.0000023D1EAF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: lz4wnSavmK.exe, 00000001.00000002.1781149147.0000023D1EAF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/All
Source: lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1723480325.0000023D1DEAA000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722821384.0000023D1DE8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: lz4wnSavmK.exe, 00000001.00000002.1781149147.0000023D1EAF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://paypal.com
Source: lz4wnSavmK.exe, 00000001.00000002.1780284238.0000023D1E180000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: lz4wnSavmK.exe, 00000001.00000002.1788703663.00007FFDFB684000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://peps.python.org/pep-0649/)
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0685/
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://peps.python.org/pep-0749/)-implementing
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://playstation.com
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://pypi.org/project/attrs/)
Source: lz4wnSavmK.exe, 00000001.00000002.1781149147.0000023D1EAF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/cryptography/
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://pypi.org/project/importlib_metadata
Source: lz4wnSavmK.exe, 00000000.00000003.1700587052.000001A0783B9000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://pypi.org/project/setuptools/
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
Source: lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://reddit.com
Source: lz4wnSavmK.exe, 00000001.00000002.1780951794.0000023D1E7D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: lz4wnSavmK.exe, 00000001.00000002.1781407808.0000023D1EF60000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: lz4wnSavmK.exe, 00000001.00000002.1781407808.0000023D1EF60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.ioe
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://riotgames.com
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://s.optifine.net/capes/
Source: lz4wnSavmK.exe, 00000001.00000002.1781149147.0000023D1EAF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: lz4wnSavmK.exe, 00000001.00000003.1711866250.0000023D1DEE1000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1711640674.0000023D1DEBB000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710105519.0000023D1E052000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1713115040.0000023D1DED7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: lz4wnSavmK.exe, 00000001.00000003.1714144801.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1711360568.0000023D1DFE8000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1718708610.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722821384.0000023D1DF3D000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710105519.0000023D1E052000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1717256810.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1713760386.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710196493.0000023D1DF1A000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1715779434.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710158772.0000023D1DFEC000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710792075.0000023D1DFE8000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1711360568.0000023D1DFB9000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1713115040.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710792075.0000023D1DFB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: lz4wnSavmK.exe, 00000001.00000002.1780216940.0000023D1E080000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: lz4wnSavmK.exe, 00000001.00000003.1710105519.0000023D1E052000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710105519.0000023D1DFFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:
Source: lz4wnSavmK.exe, 00000001.00000003.1710105519.0000023D1E052000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710105519.0000023D1DFFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:r;Nr
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://skype.com
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spotify.com
Source: lz4wnSavmK.exe, 00000001.00000002.1783857686.0000023D1FE80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/blxstealer
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).
Source: lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
Source: METADATA.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1FB000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: lz4wnSavmK.exe, 00000001.00000002.1782074997.0000023D1F3FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: lz4wnSavmK.exe, 00000001.00000003.1722821384.0000023D1DF3D000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1718708610.0000023D1DF3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitch.tv
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779810317.0000023D1DC68000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1723458510.0000023D1E685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/home
Source: lz4wnSavmK.exe, 00000001.00000002.1781149147.0000023D1EAF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.json
Source: lz4wnSavmK.exe, 00000001.00000002.1781149147.0000023D1EAF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.jsonc
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://uguu.se/api.php?d=upload
Source: lz4wnSavmK.exe, 00000001.00000003.1722653466.0000023D1E572000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uguu.se/api.php?d=uploadr
Source: lz4wnSavmK.exe, 00000001.00000002.1781339387.0000023D1EE10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: lz4wnSavmK.exe, 00000001.00000002.1781277030.0000023D1ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://users.roblox.com/v1/users/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988
Source: METADATA2.0.dr	String found in binary or memory: https://wheel.readthedocs.io/
Source: lz4wnSavmK.exe, 00000000.00000003.1700587052.000001A0783B9000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://wheel.readthedocs.io/en/stable/news.html
Source: lz4wnSavmK.exe, 00000001.00000003.1715669459.0000023D1E404000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1715669459.0000023D1E3B5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1717190054.0000023D1E40E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1720252703.0000023D1E300000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722484250.0000023D1E2F8000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1717792025.0000023D1E300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: lz4wnSavmK.exe, 00000000.00000003.1689479571.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: lz4wnSavmK.exe, 00000000.00000003.1689479571.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1689479571.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1689554134.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/)
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/FilePreviews.svg
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Klaviyo.svg
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Tidelift.svg
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Variomedia.svg
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/en/latest/names.html)
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html
Source: METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes)
Source: lz4wnSavmK.exe, 00000001.00000002.1779734852.0000023D1DB40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/3clo0b3x6nfajqm27kvx6/exodus.asar?rlkey=200tiyus0rc0u3u4j9kf517l0&st=
Source: lz4wnSavmK.exe, 00000001.00000002.1779734852.0000023D1DB40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/xtt2n593d5n4svefktjhy/atomic.asar?rlkey=5refutaevle4aapp0p6hgn7q1&st=
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.guilded.gg/api/me
Source: lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmp, lz4wnSavmK.exe, 00000001.00000002.1788326331.00007FFDFB263000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: lz4wnSavmK.exe, 00000001.00000002.1781149147.0000023D1EAF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.patreon.com/api/current_user?include=connected_socials%2Ccampaign.connected_socials&json
Source: lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: lz4wnSavmK.exe, 00000001.00000003.1717792025.0000023D1E2BA000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1717230741.0000023D1E3D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: lz4wnSavmK.exe, 00000000.00000003.1700587052.000001A0783B9000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0427/
Source: lz4wnSavmK.exe, 00000001.00000002.1779614953.0000023D1D8F0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/ftp/python/3.12.6/python-3.12.6-amd64.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1789161726.00007FFDFB7F4000.00000008.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: lz4wnSavmK.exe, 00000001.00000002.1788703663.00007FFDFB684000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.roblox.com/mobileapi/userinfo
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profile
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spotify.com/eg-en/api/account/v1/datalayer/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/api/user/list/?count=1&minCursor=0&scene=67&secUid=
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/passport/web/account/info/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/
Source: lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://www.variomedia.de/
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/(
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://xbox.com
Source: lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722653466.0000023D1E572000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722484250.0000023D1E2F8000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com

Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C631000	0_2_00007FF77C631000
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C650938	0_2_00007FF77C650938
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C6569D4	0_2_00007FF77C6569D4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C638BD0	0_2_00007FF77C638BD0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C655C70	0_2_00007FF77C655C70
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C63AD1D	0_2_00007FF77C63AD1D
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C643610	0_2_00007FF77C643610
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C64E5E0	0_2_00007FF77C64E5E0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C641DC4	0_2_00007FF77C641DC4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C645DA0	0_2_00007FF77C645DA0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C649F10	0_2_00007FF77C649F10
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C655EEC	0_2_00007FF77C655EEC
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C64DF60	0_2_00007FF77C64DF60
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C648804	0_2_00007FF77C648804
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C641FD0	0_2_00007FF77C641FD0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C6417B0	0_2_00007FF77C6417B0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C659798	0_2_00007FF77C659798
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C639870	0_2_00007FF77C639870
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C6518E4	0_2_00007FF77C6518E4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C648154	0_2_00007FF77C648154
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C65411C	0_2_00007FF77C65411C
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C643A14	0_2_00007FF77C643A14
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C6421D4	0_2_00007FF77C6421D4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C6419B4	0_2_00007FF77C6419B4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C64DACC	0_2_00007FF77C64DACC
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C63A34B	0_2_00007FF77C63A34B
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C641BC0	0_2_00007FF77C641BC0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C656488	0_2_00007FF77C656488
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C650938	0_2_00007FF77C650938
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C642C80	0_2_00007FF77C642C80
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C653C80	0_2_00007FF77C653C80
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C63A4E4	0_2_00007FF77C63A4E4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C631000	1_2_00007FF77C631000
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C6569D4	1_2_00007FF77C6569D4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C63AD1D	1_2_00007FF77C63AD1D
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C643610	1_2_00007FF77C643610
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C64E5E0	1_2_00007FF77C64E5E0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C641DC4	1_2_00007FF77C641DC4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C645DA0	1_2_00007FF77C645DA0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C649F10	1_2_00007FF77C649F10
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C655EEC	1_2_00007FF77C655EEC
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C64DF60	1_2_00007FF77C64DF60
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C648804	1_2_00007FF77C648804
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C641FD0	1_2_00007FF77C641FD0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C6417B0	1_2_00007FF77C6417B0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C659798	1_2_00007FF77C659798
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C639870	1_2_00007FF77C639870
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C6518E4	1_2_00007FF77C6518E4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C648154	1_2_00007FF77C648154
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C650938	1_2_00007FF77C650938
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C65411C	1_2_00007FF77C65411C
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C643A14	1_2_00007FF77C643A14
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C6421D4	1_2_00007FF77C6421D4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C6419B4	1_2_00007FF77C6419B4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C64DACC	1_2_00007FF77C64DACC
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C63A34B	1_2_00007FF77C63A34B
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C638BD0	1_2_00007FF77C638BD0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C641BC0	1_2_00007FF77C641BC0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C656488	1_2_00007FF77C656488
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C650938	1_2_00007FF77C650938
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C642C80	1_2_00007FF77C642C80
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C653C80	1_2_00007FF77C653C80
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C655C70	1_2_00007FF77C655C70
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C63A4E4	1_2_00007FF77C63A4E4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAAF12F0	1_2_00007FFDFAAF12F0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAAF18A0	1_2_00007FFDFAAF18A0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC1AAB0	1_2_00007FFDFAC1AAB0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACA4AB0	1_2_00007FFDFACA4AB0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC89A70	1_2_00007FFDFAC89A70
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC71A80	1_2_00007FFDFAC71A80
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC96BE0	1_2_00007FFDFAC96BE0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC2BB70	1_2_00007FFDFAC2BB70
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACC2B90	1_2_00007FFDFACC2B90
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC55930	1_2_00007FFDFAC55930
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC16948	1_2_00007FFDFAC16948
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACC08A0	1_2_00007FFDFACC08A0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC6F890	1_2_00007FFDFAC6F890
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC30A50	1_2_00007FFDFAC30A50
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACC3960	1_2_00007FFDFACC3960
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC1E980	1_2_00007FFDFAC1E980
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACC4F20	1_2_00007FFDFACC4F20
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC3BF40	1_2_00007FFDFAC3BF40
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACB6EF0	1_2_00007FFDFACB6EF0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC18F10	1_2_00007FFDFAC18F10
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC7DE70	1_2_00007FFDFAC7DE70
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACB5FB0	1_2_00007FFDFACB5FB0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC94FD0	1_2_00007FFDFAC94FD0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC80FC0	1_2_00007FFDFAC80FC0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC32D20	1_2_00007FFDFAC32D20
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC16D42	1_2_00007FFDFAC16D42
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC28CF0	1_2_00007FFDFAC28CF0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC13CA0	1_2_00007FFDFAC13CA0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC69CD0	1_2_00007FFDFAC69CD0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC37C90	1_2_00007FFDFAC37C90
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC68DF0	1_2_00007FFDFAC68DF0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACB2DE0	1_2_00007FFDFACB2DE0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC57E10	1_2_00007FFDFAC57E10
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC1FD60	1_2_00007FFDFAC1FD60
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC2B310	1_2_00007FFDFAC2B310
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC84310	1_2_00007FFDFAC84310
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC352D0	1_2_00007FFDFAC352D0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC362C0	1_2_00007FFDFAC362C0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC28290	1_2_00007FFDFAC28290
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC98430	1_2_00007FFDFAC98430
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC3D3F0	1_2_00007FFDFAC3D3F0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC973F0	1_2_00007FFDFAC973F0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC16400	1_2_00007FFDFAC16400
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC9A3A0	1_2_00007FFDFAC9A3A0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC9E3D0	1_2_00007FFDFAC9E3D0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC53370	1_2_00007FFDFAC53370
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC7F360	1_2_00007FFDFAC7F360
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC14390	1_2_00007FFDFAC14390
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC21120	1_2_00007FFDFAC21120
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC140F0	1_2_00007FFDFAC140F0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACBB0F0	1_2_00007FFDFACBB0F0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC740D0	1_2_00007FFDFAC740D0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACBD0D0	1_2_00007FFDFACBD0D0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAC270C0	1_2_00007FFDFAC270C0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACC6090	1_2_00007FFDFACC6090
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACB2080	1_2_00007FFDFACB2080
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFACB1250	1_2_00007FFDFACB1250
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF3F1FB0	1_2_00007FFDFF3F1FB0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF3F23E0	1_2_00007FFDFF3F23E0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6945C0	1_2_00007FFDFF6945C0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF694810	1_2_00007FFDFF694810
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6A3A30	1_2_00007FFDFF6A3A30
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6A3300	1_2_00007FFDFF6A3300
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6C29B0	1_2_00007FFDFF6C29B0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6C2EB0	1_2_00007FFDFF6C2EB0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6C3520	1_2_00007FFDFF6C3520
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6C2490	1_2_00007FFDFF6C2490
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6C1D70	1_2_00007FFDFF6C1D70
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6C1FE0	1_2_00007FFDFF6C1FE0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6D1D30	1_2_00007FFDFF6D1D30
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6D2120	1_2_00007FFDFF6D2120
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6E1F00	1_2_00007FFDFF6E1F00
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6E21E0	1_2_00007FFDFF6E21E0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013DBD80	1_2_00007FFE013DBD80
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013FDE30	1_2_00007FFE013FDE30
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE013F5DC0	1_2_00007FFE013F5DC0

Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: String function: 00007FFDFAC19D60 appears 133 times
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: String function: 00007FFE0142CDA1 appears 153 times
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: String function: 00007FF77C632710 appears 104 times
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: String function: 00007FFE0142CD8F appears 46 times
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: String function: 00007FFDFAC18E10 appears 103 times
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: String function: 00007FF77C632910 appears 34 times
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: String function: 00007FFE013B132A appears 71 times

Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.0.dr

Static PE information: No import functions for PE file found

Source: lz4wnSavmK.exe, 00000000.00000003.1684434492.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1694240825.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1686968995.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1684544808.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1685496067.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1704156864.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1685655997.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1705156674.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1686830794.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1697953714.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes312.dll0 vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1698076537.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000000.00000003.1695047571.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe	Binary or memory string: OriginalFilename vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamelibsslH vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1779477181.0000023D1BF70000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1794353406.00007FFE1150E000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1795402257.00007FFE1322C000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1793908994.00007FFE1025D000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1789650589.00007FFDFB91D000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1791231645.00007FFE01331000.00000002.00000001.01000000.00000026.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1791115156.00007FFE01302000.00000002.00000001.01000000.00000027.sdmp	Binary or memory string: OriginalFilenamepywintypes312.dll0 vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1793510487.00007FFE0EB3B000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1788326331.00007FFDFB263000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1793788120.00007FFE101DF000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1794993187.00007FFE126D2000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1795198383.00007FFE130C7000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1795297674.00007FFE13206000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1794135288.00007FFE11079000.00000002.00000001.01000000.00000028.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1794885178.00007FFE120CB000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1794026601.00007FFE10313000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1794247394.00007FFE110F4000.00000002.00000001.01000000.00000023.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1793675468.00007FFE0EB69000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1795593880.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1795095740.00007FFE12E16000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs lz4wnSavmK.exe
Source: lz4wnSavmK.exe, 00000001.00000002.1794486341.00007FFE11545000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs lz4wnSavmK.exe

Source: classification engine

Classification label: mal52.troj.winEXE@3/109@0/2

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI72522

Jump to behavior

Source: lz4wnSavmK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: lz4wnSavmK.exe, 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: lz4wnSavmK.exe, 00000001.00000002.1781084199.0000023D1E9F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT item1, item2 FROM metadata;
Source: lz4wnSavmK.exe, 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: lz4wnSavmK.exe, 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: lz4wnSavmK.exe, 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: lz4wnSavmK.exe, lz4wnSavmK.exe, 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: lz4wnSavmK.exe, 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: lz4wnSavmK.exe, 00000001.00000002.1781084199.0000023D1E9F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT a11, a102 FROM nssPrivate WHERE a102 = ?;
Source: lz4wnSavmK.exe, 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: lz4wnSavmK.exe

ReversingLabs: Detection: 42%

Source: lz4wnSavmK.exe

String found in binary or memory: can't send non-None value to a just-started generator

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

File read: C:\Users\user\Desktop\lz4wnSavmK.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\lz4wnSavmK.exe "C:\Users\user\Desktop\lz4wnSavmK.exe"
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Process created: C:\Users\user\Desktop\lz4wnSavmK.exe "C:\Users\user\Desktop\lz4wnSavmK.exe"
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Process created: C:\Users\user\Desktop\lz4wnSavmK.exe "C:\Users\user\Desktop\lz4wnSavmK.exe"	Jump to behavior

Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: pywintypes312.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: lz4wnSavmK.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: lz4wnSavmK.exe

Static file information: File size 18082384 > 1048576

Source: lz4wnSavmK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: lz4wnSavmK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: lz4wnSavmK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: lz4wnSavmK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: lz4wnSavmK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: lz4wnSavmK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: lz4wnSavmK.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: lz4wnSavmK.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: lz4wnSavmK.exe, 00000001.00000002.1788703663.00007FFDFB684000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: lz4wnSavmK.exe, 00000000.00000003.1704860498.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: cryptography_rust.pdbc source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: lz4wnSavmK.exe, 00000001.00000002.1787982916.00007FFDFB122000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: lz4wnSavmK.exe, 00000001.00000002.1787982916.00007FFDFB122000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: crypto\bn\bn_ctx.cBN_CTX_startBN_CTX_getossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcrypto\evp\digest.cevp_md_ctx_new_exevp_md_ctx_free_algctxevp_md_init_internalEVP_DigestUpdatesizeEVP_DigestFinal_exassertion failed: mdsize <= EVP_MAX_MD_SIZEEVP_DigestFinalXOFxoflenEVP_MD_CTX_copy_exEVP_MD_CTX_ctrlmicalgssl3-msblocksizexofalgid-absentevp_md_from_algorithmupdatecrypto\evp\m_sigver.cUNDEFdo_sigver_initEVP_DigestSignUpdateEVP_DigestVerifyUpdateEVP_DigestSignFinalEVP_DigestSignEVP_DigestVerifyFinalEVP_DigestVerifycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Fri Oct 18 00:15:00 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: lz4wnSavmK.exe, 00000000.00000003.1686573636.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794842353.00007FFE120C6000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\engine\tb_digest.cENGINE_get_digestcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: lz4wnSavmK.exe, 00000000.00000003.1684434492.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1795550062.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: lz4wnSavmK.exe, 00000000.00000003.1684434492.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1795550062.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: lz4wnSavmK.exe, 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: lz4wnSavmK.exe, 00000001.00000002.1791049944.00007FFE012F1000.00000002.00000001.01000000.00000027.sdmp, pywintypes312.dll.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: lz4wnSavmK.exe, 00000001.00000002.1791049944.00007FFE012F1000.00000002.00000001.01000000.00000027.sdmp, pywintypes312.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: lz4wnSavmK.exe, 00000000.00000003.1686499755.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: lz4wnSavmK.exe, 00000000.00000003.1684544808.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794092458.00007FFE11075000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: lz4wnSavmK.exe, 00000000.00000003.1698076537.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1795257794.00007FFE13203000.00000002.00000001.01000000.0000000E.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: lz4wnSavmK.exe, 00000001.00000002.1795361278.00007FFE13221000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: lz4wnSavmK.exe, 00000000.00000003.1685856503.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794312623.00007FFE11507000.00000002.00000001.01000000.0000000B.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: lz4wnSavmK.exe, 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794421790.00007FFE1153C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: lz4wnSavmK.exe, 00000000.00000003.1684626741.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1793742340.00007FFE101D8000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: lz4wnSavmK.exe, 00000000.00000003.1687080282.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794204498.00007FFE110F2000.00000002.00000001.01000000.00000023.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: lz4wnSavmK.exe, 00000001.00000002.1793861068.00007FFE10252000.00000002.00000001.01000000.00000010.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: lz4wnSavmK.exe, 00000000.00000003.1686654453.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1795054356.00007FFE12E13000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: lz4wnSavmK.exe, 00000000.00000003.1686386630.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794421790.00007FFE1153C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: lz4wnSavmK.exe, 00000000.00000003.1684723181.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794952052.00007FFE126CD000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1795157387.00007FFE130C4000.00000002.00000001.01000000.0000000F.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb!! source: lz4wnSavmK.exe, 00000001.00000002.1791188852.00007FFE01323000.00000002.00000001.01000000.00000026.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb source: lz4wnSavmK.exe, 00000001.00000002.1791188852.00007FFE01323000.00000002.00000001.01000000.00000026.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: lz4wnSavmK.exe, 00000000.00000003.1686724846.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1793983444.00007FFE10309000.00000002.00000001.01000000.0000000D.sdmp, _socket.pyd.0.dr
Source:	Binary string: cryptography_rust.pdb source: lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: lz4wnSavmK.exe, 00000000.00000003.1687151876.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1795157387.00007FFE130C4000.00000002.00000001.01000000.0000000F.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: lz4wnSavmK.exe, 00000001.00000002.1793465071.00007FFE0EB2F000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: lz4wnSavmK.exe, 00000000.00000003.1695168851.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779477181.0000023D1BF70000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: lz4wnSavmK.exe, 00000000.00000003.1684544808.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1794092458.00007FFE11075000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: lz4wnSavmK.exe, 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: lz4wnSavmK.exe, 00000001.00000002.1793578231.00007FFE0EB4D000.00000002.00000001.01000000.00000012.sdmp, _ssl.pyd.0.dr

Source: lz4wnSavmK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: lz4wnSavmK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: lz4wnSavmK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: lz4wnSavmK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: lz4wnSavmK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: python312.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Code function: 1_2_00007FFE013B1D7B push rcx; retf

1_2_00007FFE013B1D7C

Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_websocket\mask.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_http_parser.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\propcache\_helpers_c.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\yarl\_quoting_c.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\multidict\_multidict.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_http_writer.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\frozenlist\_frozenlist.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_websocket\reader_c.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_keccak.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Jump to behavior

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Code function: 0_2_00007FF77C6376B0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF77C6376B0

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_websocket\mask.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_http_parser.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\propcache\_helpers_c.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\yarl\_quoting_c.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\multidict\_multidict.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_http_writer.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\frozenlist\_frozenlist.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_websocket\reader_c.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-18278

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

API coverage: 1.3 %

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File Volume queried: \Device\CdRom0\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C6392F0 FindFirstFileExW,FindClose,	0_2_00007FF77C6392F0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C6383B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF77C6383B0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C6518E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF77C6518E4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C6392F0 FindFirstFileExW,FindClose,	1_2_00007FF77C6392F0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C6518E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF77C6518E4
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C6383B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF77C6383B0

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Code function: 1_2_00007FFDFAC20180 GetSystemInfo,

1_2_00007FFDFAC20180

Source: lz4wnSavmK.exe, 00000000.00000003.1688454426.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dqemu-ga
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwaretray
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: lz4wnSavmK.exe, 00000001.00000002.1779502514.0000023D1C003000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmware
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware Tools
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .fvboxtray
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmtoolsd
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ',.fvboxservice
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmware
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fVMware
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Gdfvmsrvc
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmhgfs.sys
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fqemu
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmhgfs.sys
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dVMware Tools
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwareuser
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmusrvc
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmmouse.sys
Source: lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmmouse.sys

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Code function: 0_2_00007FF77C64A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF77C64A684

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Code function: 0_2_00007FF77C6534F0 GetProcessHeap,

0_2_00007FF77C6534F0

Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C64A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF77C64A684
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C63C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF77C63C910
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C63D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF77C63D19C
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 0_2_00007FF77C63D37C SetUnhandledExceptionFilter,	0_2_00007FF77C63D37C
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C64A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF77C64A684
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C63C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF77C63C910
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C63D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF77C63D19C
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FF77C63D37C SetUnhandledExceptionFilter,	1_2_00007FF77C63D37C
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAAF3068 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFAAF3068
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAAF2AA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFAAF2AA0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFAD3CAF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFAD3CAF0
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF3F1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFF3F1960
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF3F1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFF3F1390
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF691390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFF691390
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF691960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFF691960
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6A1030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFF6A1030
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6A1A80 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFF6A1A80
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6C1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFF6C1390
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6C1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFF6C1960
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6D1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFF6D1390
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6D1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFF6D1960
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6E1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFDFF6E1390
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFDFF6E1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFDFF6E1960
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Code function: 1_2_00007FFE00281960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE00281960

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Process created: C:\Users\user\Desktop\lz4wnSavmK.exe "C:\Users\user\Desktop\lz4wnSavmK.exe"

Jump to behavior

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Code function: 0_2_00007FF77C6595E0 cpuid

0_2_00007FF77C6595E0

Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_websocket VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\attrs-24.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\attrs-24.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\attrs-24.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\attrs-24.2.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\_wmi.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\jaraco VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\_asyncio.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\_overlapped.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lz4wnSavmK.exe	Queries volume information: C:\Users\user\Desktop\lz4wnSavmK.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Code function: 0_2_00007FF77C63D080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF77C63D080

Source: C:\Users\user\Desktop\lz4wnSavmK.exe

Code function: 0_2_00007FF77C655C70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF77C655C70

Stealing of Sensitive Information

Yara detected Generic Python Stealer

Source: Yara match

File source: Process Memory Space: lz4wnSavmK.exe PID: 7300, type: MEMORYSTR

Remote Access Functionality

Yara detected Generic Python Stealer

Source: Yara match

File source: Process Memory Space: lz4wnSavmK.exe PID: 7300, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	25 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
lz4wnSavmK.exe	42%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_curve25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_curve448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_cffi_backend.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_http_parser.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_http_writer.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_websocket\mask.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_websocket\reader_c.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\charset_normalizer\md.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\frozenlist\_frozenlist.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI72522\libssl-3.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:	0%	Avira URL Cloud	safe
https://api.namemc.com/profile/	0%	Avira URL Cloud	safe
https://www.attrs.org/en/stable/changelog.html	0%	Avira URL Cloud	safe
https://uguu.se/api.php?d=uploadr	0%	Avira URL Cloud	safe
https://www.attrs.org/en/stable/why.html#data-classes)	0%	Avira URL Cloud	safe
https://www.variomedia.de/	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	0%	Avira URL Cloud	safe
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	0%	Avira URL Cloud	safe
https://filepreviews.io/	0%	Avira URL Cloud	safe
https://www.attrs.org/	0%	Avira URL Cloud	safe
https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).	0%	Avira URL Cloud	safe
http://www.accv.es00	0%	Avira URL Cloud	safe
http://www.firmaprofesional.com/cps0	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.riotgames.com/api/account/v1/user	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues/8996	lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp	false		high
https://github.com/astral-sh/ruff	lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/giampaolo/psutil/issues/875.	lz4wnSavmK.exe, 00000001.00000002.1783857686.0000023D1FE80000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/251	lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	lz4wnSavmK.exe, 00000001.00000002.1780216940.0000023D1E080000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg	lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
http://crl.dhimyotis.com/certignarootca.crl0	lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/aio-libs/aiohttp/discussions/6044	lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1783388416.0000023D1FA00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/issues	lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://paypal.com	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://python.org	lz4wnSavmK.exe, 00000001.00000002.1781407808.0000023D1EF60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	lz4wnSavmK.exe, 00000001.00000002.1779810317.0000023D1DC40000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1708416694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1708780612.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710995990.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1709094694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779502514.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wheel.readthedocs.io/en/stable/news.html	lz4wnSavmK.exe, 00000000.00000003.1700587052.000001A0783B9000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	false		high
https://github.com/sponsors/hynek	METADATA0.0.dr	false		high
https://oauth.reddit.com/api/v1/me	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://importlib-metadata.readthedocs.io/	METADATA.0.dr	false		high
https://store.steampowered.com	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://goo.gl/zeJZl.	lz4wnSavmK.exe, 00000001.00000002.1783388416.0000023D1FA00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	lz4wnSavmK.exe, 00000000.00000003.1689479571.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1689479571.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1689554134.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	false		high
https://ebay.com	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/core-metadata/	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://epicgames.com	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	lz4wnSavmK.exe, 00000001.00000003.1713760386.0000023D1E03A000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722821384.0000023D1DF3D000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1712804975.0000023D1E03A000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1714144801.0000023D1E039000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1714798755.0000023D1E039000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1716248069.0000023D1E039000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710604007.0000023D1E052000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1712247311.0000023D1E03A000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1711581460.0000023D1E04C000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1717256810.0000023D1E036000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1718708610.0000023D1E004000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	lz4wnSavmK.exe, 00000001.00000002.1780889027.0000023D1E6B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/3clo0b3x6nfajqm27kvx6/exodus.asar?rlkey=200tiyus0rc0u3u4j9kf517l0&st=	lz4wnSavmK.exe, 00000001.00000002.1779734852.0000023D1DB40000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).	lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false	Avira URL Cloud: safe	unknown
https://readthedocs.org/projects/importlib-metadata/badge/?version=latest	lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	lz4wnSavmK.exe, 00000001.00000002.1780951794.0000023D1E7D0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crlK	lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.namemc.com/profile/	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.com/api/v9/users/	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ipinfo.io/json	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://blog.jaraco.com/skeleton	lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/python-attrs/attrs/issues/136	lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc3610	lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F1FB000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/platformdirs/platformdirs	lz4wnSavmK.exe, 00000001.00000002.1780951794.0000023D1E7D0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	lz4wnSavmK.exe, 00000001.00000002.1781339387.0000023D1EE10000.00000004.00001000.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md	lz4wnSavmK.exe, 00000000.00000003.1700587052.000001A0783B9000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:	lz4wnSavmK.exe, 00000001.00000003.1710105519.0000023D1E052000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710105519.0000023D1DFFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://catbox.moe/user/api.php	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779614953.0000023D1D8F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	lz4wnSavmK.exe, 00000001.00000002.1781339387.0000023D1EE10000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-attrs/attrs/issues/1330)	lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687956062.000001A0783C5000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://pypi.org/project/build/).	lz4wnSavmK.exe, 00000001.00000002.1781149147.0000023D1EAF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.3	lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2	lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781407808.0000023D1EF60000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/wheel	lz4wnSavmK.exe, 00000000.00000003.1700587052.000001A0783B9000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	false		high
https://www.python.org/dev/peps/pep-0427/	lz4wnSavmK.exe, 00000000.00000003.1700587052.000001A0783B9000.00000004.00000020.00020000.00000000.sdmp, METADATA2.0.dr	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	lz4wnSavmK.exe, 00000001.00000002.1779810317.0000023D1DC40000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1708416694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1708780612.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710995990.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1709094694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779502514.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://instagram.com	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	lz4wnSavmK.exe, 00000001.00000003.1714144801.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1718708610.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1711640674.0000023D1DEBB000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722821384.0000023D1DF3D000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1717256810.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1713760386.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1715779434.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1712146990.0000023D1E310000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1711302743.0000023D1E310000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1713115040.0000023D1DFB2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.python.org/pipermail/python-dev/2012-June/120787.html.	lz4wnSavmK.exe, 00000001.00000002.1783388416.0000023D1FA00000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F303000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/	lz4wnSavmK.exe, 00000001.00000003.1723458510.0000023D1E685000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	lz4wnSavmK.exe, 00000000.00000003.1689479571.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	false		high
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	lz4wnSavmK.exe, 00000001.00000002.1779734852.0000023D1DB40000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	lz4wnSavmK.exe, 00000001.00000002.1779734852.0000023D1DB40000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filepreviews.io/	lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false	Avira URL Cloud: safe	unknown
https://twitch.tv	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/why.html#data-classes)	lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783C4000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false	Avira URL Cloud: safe	unknown
https://img.shields.io/badge/skeleton-2024-informational	lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the	lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1723480325.0000023D1DEAA000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722821384.0000023D1DE8B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/installation/	lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	lz4wnSavmK.exe, 00000001.00000002.1781015744.0000023D1E8D0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	lz4wnSavmK.exe, 00000001.00000002.1780862294.0000023D1E66E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	lz4wnSavmK.exe, 00000001.00000002.1781339387.0000023D1EE10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/changelog.html	lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false	Avira URL Cloud: safe	unknown
https://discord.com/api/v6/guilds/	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://uguu.se/api.php?d=uploadr	lz4wnSavmK.exe, 00000001.00000003.1722653466.0000023D1E572000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.variomedia.de/	lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false	Avira URL Cloud: safe	unknown
http://www.cert.fnmt.es/dpcs/	lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E5F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722653466.0000023D1E572000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1722484250.0000023D1E2F8000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/v/importlib_metadata.svg	lz4wnSavmK.exe, 00000000.00000003.1698413661.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/jaraco/jaraco.functools/issues/5	lz4wnSavmK.exe, 00000001.00000002.1780951794.0000023D1E7D0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es00	lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.rfc-editor.org/info/rfc7253	lz4wnSavmK.exe, 00000001.00000002.1781660325.0000023D1F38B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues	lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1786670466.00007FFDFA0BA000.00000002.00000001.01000000.00000029.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E5F9000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1721648911.0000023D1E502000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/	METADATA0.0.dr	false	Avira URL Cloud: safe	unknown
https://mahler:8092/site-updates.py	lz4wnSavmK.exe, 00000001.00000003.1717792025.0000023D1E2BA000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1780351948.0000023D1E2B0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1717230741.0000023D1E3D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	lz4wnSavmK.exe, 00000001.00000003.1722821384.0000023D1DF3D000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1718708610.0000023D1DF3D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/	lz4wnSavmK.exe, 00000000.00000003.1689106912.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.gg/	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ip-api.com/json	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).	lz4wnSavmK.exe, 00000000.00000003.1687743014.000001A0783B6000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false	Avira URL Cloud: safe	unknown
https://127.0.0.1:8443	lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1781407808.0000023D1EF60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.firmaprofesional.com/cps0	lz4wnSavmK.exe, 00000001.00000002.1781474952.0000023D1F0F0000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779999453.0000023D1DE80000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779614953.0000023D1D96C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	lz4wnSavmK.exe, 00000001.00000002.1781277030.0000023D1ECF0000.00000004.00001000.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1723458510.0000023D1E685000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	lz4wnSavmK.exe, 00000001.00000002.1780504019.0000023D1E56F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	lz4wnSavmK.exe, 00000001.00000003.1708416694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707217368.0000023D1DC46000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1707155735.0000023D1DC4E000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1708780612.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1710995990.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000003.1709094694.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp, lz4wnSavmK.exe, 00000001.00000002.1779502514.0000023D1C05F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://friends.roblox.com/v1/users/	lz4wnSavmK.exe, 00000001.00000002.1781213245.0000023D1EBF0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
163.5.242.208	unknown	France		56339	EPITECHFR	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570262
Start date and time:	2024-12-06 17:47:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lz4wnSavmK.exe renamed because original name is a hash value
Original Sample Name:	751a7a40b57d187a0b51d92c550e1309.exe
Detection:	MAL
Classification:	mal52.troj.winEXE@3/109@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Excluded IPs from analysis (whitelisted): 20.12.23.50
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
VT rate limit hit for: lz4wnSavmK.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
163.5.242.208	dipwo1iToJ.exe	Get hash	malicious	Python Stealer	Browse	163.5.242.208/7236785358_chat.txt

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EPITECHFR	dipwo1iToJ.exe	Get hash	malicious	Python Stealer	Browse	163.5.242.208
	105vjMVwfJ.dll	Get hash	malicious	CobaltStrike	Browse	163.5.169.26
	7RDTQuL8WF.exe	Get hash	malicious	CobaltStrike	Browse	163.5.169.26
	botx.spc.elf	Get hash	malicious	Mirai	Browse	163.5.176.64
	spc.elf	Get hash	malicious	Mirai	Browse	163.5.130.180
	m68k.elf	Get hash	malicious	Mirai	Browse	163.5.176.71
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	163.5.152.99
	SecuriteInfo.com.Win32.MalwareX-gen.20028.17631.exe	Get hash	malicious	AsyncRAT	Browse	163.5.160.86
	jNA5BK2z12.exe	Get hash	malicious	AsyncRAT	Browse	163.5.160.86
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	163.5.63.254

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_ARC4.pyd	dipwo1iToJ.exe	Get hash	malicious	Python Stealer	Browse
	ROh2ijuEpr.exe	Get hash	malicious	Babuk, Conti	Browse
	zed.exe	Get hash	malicious	Unknown	Browse
	back.ps1	Get hash	malicious	Unknown	Browse
	zed.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, LummaC Stealer, Nymaim, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse
	file.exe	Get hash	malicious	Amadey, XWorm	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.640339306680604
Encrypted:	false
SSDEEP:	192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
MD5:	BCD8CAAF9342AB891BB1D8DD45EF0098
SHA1:	EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
SHA-256:	78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
SHA-512:	8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: dipwo1iToJ.exe, Detection: malicious, Browse Filename: ROh2ijuEpr.exe, Detection: malicious, Browse Filename: zed.exe, Detection: malicious, Browse Filename: back.ps1, Detection: malicious, Browse Filename: zed.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.0194545642425075
Encrypted:	false
SSDEEP:	192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
MD5:	F19CB847E567A31FAB97435536C7B783
SHA1:	4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
SHA-256:	1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
SHA-512:	382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.037456384995606
Encrypted:	false
SSDEEP:	192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
MD5:	DC14677EA8A8C933CC41F9CCF2BEDDC1
SHA1:	A6FB87E8F3540743097A467ABE0723247FDAF469
SHA-256:	68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
SHA-512:	3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.09191874780435
Encrypted:	false
SSDEEP:	192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
MD5:	C09BB8A30F0F733C81C5C5A3DAD8D76D
SHA1:	46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
SHA-256:	8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
SHA-512:	691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.541423493519083
Encrypted:	false
SSDEEP:	384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
MD5:	0AB25F99CDAACA6B11F2ECBE8223CAD5
SHA1:	7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
SHA-256:	6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
SHA-512:	11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.367749645917753
Encrypted:	false
SSDEEP:	192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
MD5:	B6EA675C3A35CD6400A7ECF2FB9530D1
SHA1:	0E41751AA48108D7924B0A70A86031DDE799D7D6
SHA-256:	76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
SHA-512:	E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.41148259289073
Encrypted:	false
SSDEEP:	192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
MD5:	F14E1AA2590D621BE8C10321B2C43132
SHA1:	FD84D11619DFFDF82C563E45B48F82099D9E3130
SHA-256:	FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
SHA-512:	A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.041302713678401
Encrypted:	false
SSDEEP:	384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
MD5:	B127CAE435AEB8A2A37D2A1BC1C27282
SHA1:	2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
SHA-256:	538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
SHA-512:	4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.530656045206549
Encrypted:	false
SSDEEP:	384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
MD5:	2E15AA6F97ED618A3236CFA920988142
SHA1:	A9D556D54519D3E91FA19A936ED291A33C0D1141
SHA-256:	516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
SHA-512:	A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7080156150187396
Encrypted:	false
SSDEEP:	192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
MD5:	40390F2113DC2A9D6CFAE7127F6BA329
SHA1:	9C886C33A20B3F76B37AA9B10A6954F3C8981772
SHA-256:	6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
SHA-512:	617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.159963979391524
Encrypted:	false
SSDEEP:	192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
MD5:	899895C0ED6830C4C9A3328CC7DF95B6
SHA1:	C02F14EBDA8B631195068266BA20E03210ABEABC
SHA-256:	18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
SHA-512:	0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.270418334522813
Encrypted:	false
SSDEEP:	192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
MD5:	C4C525B081F8A0927091178F5F2EE103
SHA1:	A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
SHA-256:	4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
SHA-512:	7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	4.231032526864278
Encrypted:	false
SSDEEP:	384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
MD5:	F9E266F763175B8F6FD4154275F8E2F0
SHA1:	8BE457700D58356BC2FA7390940611709A0E5473
SHA-256:	14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
SHA-512:	EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.252429732285762
Encrypted:	false
SSDEEP:	384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
MD5:	DECF524B2D53FCD7D4FA726F00B3E5FC
SHA1:	E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
SHA-256:	58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
SHA-512:	EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.690163963718492
Encrypted:	false
SSDEEP:	192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
MD5:	80BB1E0E06ACAF03A0B1D4EF30D14BE7
SHA1:	B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
SHA-256:	5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
SHA-512:	2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.1215844022564285
Encrypted:	false
SSDEEP:	384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
MD5:	3727271FE04ECB6D5E49E936095E95BC
SHA1:	46182698689A849A8C210A8BF571D5F574C6F5B1
SHA-256:	3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
SHA-512:	5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.293810509074883
Encrypted:	false
SSDEEP:	384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
MD5:	78AEF441C9152A17DD4DC40C7CC9DF69
SHA1:	6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
SHA-256:	56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
SHA-512:	27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.862619033406922
Encrypted:	false
SSDEEP:	96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
MD5:	19E0ABF76B274C12FF624A16713F4999
SHA1:	A4B370F556B925F7126BF87F70263D1705C3A0DB
SHA-256:	D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
SHA-512:	D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.227045547076371
Encrypted:	false
SSDEEP:	192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
MD5:	309D6F6B0DD022EBD9214F445CAC7BB9
SHA1:	ABD22690B7AD77782CFC0D2393D0C038E16070B0
SHA-256:	4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
SHA-512:	D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.176369829782773
Encrypted:	false
SSDEEP:	192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
MD5:	D54FEB9A270B212B0CCB1937C660678A
SHA1:	224259E5B684C7AC8D79464E51503D302390C5C9
SHA-256:	032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
SHA-512:	29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.047563322651927
Encrypted:	false
SSDEEP:	384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
MD5:	52DCD4151A9177CF685BE4DF48EA9606
SHA1:	F444A4A5CBAE9422B408420115F0D3FF973C9705
SHA-256:	D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
SHA-512:	64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.09893680790018
Encrypted:	false
SSDEEP:	192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
MD5:	F929B1A3997427191E07CF52AC883054
SHA1:	C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
SHA-256:	5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
SHA-512:	2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.451865349855574
Encrypted:	false
SSDEEP:	384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
MD5:	1FA5E257A85D16E916E9C22984412871
SHA1:	1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
SHA-256:	D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
SHA-512:	E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.104245335186531
Encrypted:	false
SSDEEP:	192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
MD5:	FAD578A026F280C1AE6F787B1FA30129
SHA1:	9A3E93818A104314E172A304C3D117B6A66BEB55
SHA-256:	74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
SHA-512:	ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.671305741258107
Encrypted:	false
SSDEEP:	384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
MD5:	556E6D0E5F8E4DA74C2780481105D543
SHA1:	7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
SHA-256:	247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
SHA-512:	28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h..9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ...............P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.878701941774916
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
MD5:	2F2655A7BBFE08D43013EDDA27E77904
SHA1:	33D51B6C423E094BE3E34E5621E175329A0C0914
SHA-256:	C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
SHA-512:	8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.881781476285865
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
MD5:	CDE035B8AB3D046B1CE37EEE7EE91FA0
SHA1:	4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
SHA-256:	16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
SHA-512:	C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.837887867708438
Encrypted:	false
SSDEEP:	768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
MD5:	999D431197D7E06A30E0810F1F910B9A
SHA1:	9BFF781221BCFFD8E55485A08627EC2A37363C96
SHA-256:	AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
SHA-512:	A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.895310340516013
Encrypted:	false
SSDEEP:	768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
MD5:	0931ABBF3AED459B1A2138B551B1D3BB
SHA1:	9EC0296DDAF574A89766A2EC035FC30073863AB0
SHA-256:	1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
SHA-512:	9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.967737129255606
Encrypted:	false
SSDEEP:	192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
MD5:	5F057A380BACBA4EF59C0611549C0E02
SHA1:	4B758D18372D71F0AA38075F073722A55B897F71
SHA-256:	BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
SHA-512:	E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.007867576025166
Encrypted:	false
SSDEEP:	192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
MD5:	49BCA1B7DF076D1A550EE1B7ED3BD997
SHA1:	47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
SHA-256:	49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
SHA-512:	8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.226023387740053
Encrypted:	false
SSDEEP:	384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
MD5:	CB5CFDD4241060E99118DEEC6C931CCC
SHA1:	1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
SHA-256:	A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
SHA-512:	8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.262055670423592
Encrypted:	false
SSDEEP:	192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
MD5:	18D2D96980802189B23893820714DA90
SHA1:	5DEE494D25EB79038CBC2803163E2EF69E68274C
SHA-256:	C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
SHA-512:	0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..\|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..\|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.913843738203007
Encrypted:	false
SSDEEP:	384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
MD5:	EF472BA63FD22922CA704B1E7B95A29E
SHA1:	700B68E7EF95514D5E94D3C6B10884E1E187ACD8
SHA-256:	66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
SHA-512:	DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..\|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.735350805948923
Encrypted:	false
SSDEEP:	192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
MD5:	3B1CE70B0193B02C437678F13A335932
SHA1:	063BFD5A32441ED883409AAD17285CE405977D1F
SHA-256:	EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
SHA-512:	0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_curve25519.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.705606408072877
Encrypted:	false
SSDEEP:	384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
MD5:	FF33C306434DEC51D39C7BF1663E25DA
SHA1:	665FCF47501F1481534597C1EAC2A52886EF0526
SHA-256:	D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
SHA-512:	66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_curve448.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.0189903352673655
Encrypted:	false
SSDEEP:	1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
MD5:	F267BF4256F4105DAD0D3E59023011ED
SHA1:	9BC6CA0F375CE49D5787C909D290C07302F58DA6
SHA-256:	1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
SHA-512:	A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	7.613224993327352
Encrypted:	false
SSDEEP:	12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
MD5:	1EFD7F7CB1C277416011DE6F09C355AF
SHA1:	C0F97652AC2703C325AB9F20826A6F84C63532F2
SHA-256:	AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
SHA-512:	2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.8551858881598795
Encrypted:	false
SSDEEP:	384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
MD5:	C5FB377F736ED731B5578F57BB765F7A
SHA1:	5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
SHA-256:	32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
SHA-512:	D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.064677498000638
Encrypted:	false
SSDEEP:	1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
MD5:	8A0C0AA820E98E83AC9B665A9FD19EAF
SHA1:	6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
SHA-256:	4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
SHA-512:	52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.675380950473425
Encrypted:	false
SSDEEP:	96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
MD5:	44B930B89CE905DB4716A548C3DB8DEE
SHA1:	948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
SHA-256:	921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
SHA-512:	79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..\|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.625428549874022
Encrypted:	false
SSDEEP:	96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
MD5:	F24F9356A6BDD29B9EF67509A8BC3A96
SHA1:	A26946E938304B4E993872C6721EB8CC1DCBE43B
SHA-256:	034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
SHA-512:	C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.641929675972235
Encrypted:	false
SSDEEP:	1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5:	4585A96CC4EEF6AAFD5E27EA09147DC6
SHA1:	489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
SHA-256:	A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
SHA-512:	D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49520
Entropy (8bit):	6.65700274508223
Encrypted:	false
SSDEEP:	768:YEgYXUcHJcUJSDW/tfxL1qBSHGm6Ub/I2Hi09z0XQKBcRmuU9zuKl:YvGS8fZ1esJwUpz0X3B+d8zuKl
MD5:	7E668AB8A78BD0118B94978D154C85BC
SHA1:	DBAC42A02A8D50639805174AFD21D45F3C56E3A0
SHA-256:	E4B533A94E02C574780E4B333FCF0889F65ED00D39E32C0FBBDA2116F185873F
SHA-512:	72BB41DB17256141B06E2EAEB8FC65AD4ABDB65E4B5F604C82B9E7E7F60050734137D602E0F853F1A38201515655B6982F2761EE0FA77C531AA58591C95F0032
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d....J.$.........." ...".<...8.......A....................................................`A........................................0m.......m..x....................r..pO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71448
Entropy (8bit):	6.243013214204417
Encrypted:	false
SSDEEP:	1536:nhaPPkvDcBlqCTFFQ/ObfW11swNIGOnL7SyaeCxT:hanCDcnqCJFOObfW11swNIGOnLoeE
MD5:	2CD68FF636394D3019411611E27D0A3B
SHA1:	DA369C5D1A32F68639170D8A265A9EA49C2C8EBD
SHA-256:	0D4FBD46F922E548060EA74C95E99DC5F19B1DF69BE17706806760515C1C64FE
SHA-512:	37388D137454F52057B2376D95ABCC955FA1EDC3E20B96445FA45D1860544E811DF0C547F221C8671DC1A4D90262BB20F3B9F114252F3C47A8C3829951A2CE51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:.T.[...[...[...#*..[...'...[...'...[...'...[...'...[...&...[..M#...[...[...[...&...[...&...[...&F..[...&...[..Rich.[..........................PE..d...Q..e.........." ...#.f................................................... ......A&....`.............................................P......d......................../..............T...........................@...@............................................text...)d.......f.................. ..`.rdata..`O.......P...j..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84760
Entropy (8bit):	6.584507188180646
Encrypted:	false
SSDEEP:	1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
MD5:	C7CE973F261F698E3DB148CCAD057C96
SHA1:	59809FD48E8597A73211C5DF64C7292C5D120A10
SHA-256:	02D772C03704FE243C8DE2672C210A5804D075C1F75E738D6130A173D08DFCDE
SHA-512:	A924750B1825747A622EEF93331FD764D824C954297E37E8DC93A450C11AA7AB3AD7C3B823B11656B86E64DE3CD5D409FDA15DB472488DFAA4BB50341F0B29D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.l.3...3...3...:...9......1......0......>......;......7.......0...x...1...3...l.......;.......2.......2.......2...Rich3...................PE..d...f..e.........." ...#.....^...............................................P.......@....`.............................................H............0....... ..,......../...@..........T...........................p...@............................................text............................... ..`.rdata..p>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_cffi_backend.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179712
Entropy (8bit):	6.180800197956408
Encrypted:	false
SSDEEP:	3072:IULjhBCx8qImKrUltSfGzdMcbb9CF8OS7jkSTLkKWlgeml:IgCeqImzSfIMcNCvOkSTLLWWem
MD5:	FCB71CE882F99EC085D5875E1228BDC1
SHA1:	763D9AFA909C15FEA8E016D321F32856EC722094
SHA-256:	86F136553BA301C70E7BADA8416B77EB4A07F76CCB02F7D73C2999A38FA5FA5B
SHA-512:	4A0E98AB450453FD930EDC04F0F30976ABB9214B693DB4B6742D784247FB062C57FAFAFB51EB04B7B4230039AB3B07D2FFD3454D6E261811F34749F2E35F04D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......a..#%p.p%p.p%p.p,..p)p.p5.q'p.p5.zp!p.p5.q!p.p5.q-p.p5.q)p.pn..q!p.p6.q&p.p%p.p.p.pm..q!p.p,..p$p.pm..q$p.pm.xp$p.pm..q$p.pRich%p.p........................PE..d...W..f.........." ...).....B......`........................................0............`..........................................h..l....i..................T............ .......O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...p..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124696
Entropy (8bit):	6.1345016966871455
Encrypted:	false
SSDEEP:	3072:kuiS11BYNd+5AWdu41qOqJ/f/EX4lCPIWu1ptpIGLP+z:Pl1U+Ke/16f/ExWI
MD5:	10FDCF63D1C3C3B7E5861FBB04D64557
SHA1:	1AA153EFEC4F583643046618B60E495B6E03B3D7
SHA-256:	BC3B83D2DC9E2F0E6386ED952384C6CF48F6EED51129A50DFD5EF6CBBC0A8FB3
SHA-512:	DC702F4100ED835E198507CD06FA5389A063D4600FC08BE780690D729AB62114FD5E5B201D511B5832C14E90A5975ED574FC96EDB5A9AB9EB83F607C7A712C7F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...z.z.z.s...\|....x....v....r....~.....x.1...{.1...\|.....y.z.......\|.....{...o.{.....{.Richz.................PE..d...c..e.........." ...#............p^..............................................".....`..........................................`.......a.........................../......p.......T...............................@............................................text............................... ..`.rdata...l.......n..................@..@.data....4.......0...h..............@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	253208
Entropy (8bit):	6.567915765795386
Encrypted:	false
SSDEEP:	6144:DV0lmIvcruIDCiryrjqPBTn9qWM53pLW1AuDRRRctULoT3TdTx:SN0rQiryr8TaV+QTdTx
MD5:	21C73E7E0D7DAD7A1FE728E3B80CE073
SHA1:	7B363AF01E83C05D0EA75299B39C31D948BBFE01
SHA-256:	A28C543976AA4B6D37DA6F94A280D72124B429F458D0D57B7DBCF71B4BEA8F73
SHA-512:	0357102BFFC2EC2BC6FF4D9956D6B8E77ED8558402609E558F1C1EBC1BACA6AEAA5220A7781A69B783A54F3E76362D1F74D817E4EE22AAC16C7F8C86B6122390
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.R.!...!...!...Y=..!..+]...!..+]...!..+]...!..+]...!..M\...!...Y...!...!...!..M\...!..M\...!..M\...!..M\Q..!..M\...!..Rich.!..........PE..d...T..e.........." ...#.v...<......\|.....................................................`..........................................T..P....T...................'......./......P...`...T........................... ...@............................................text....t.......v.................. ..`.rdata...............z..............@..@.data....*...p...$...R..............@....pdata...'.......(...v..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64792
Entropy (8bit):	6.219813461442214
Encrypted:	false
SSDEEP:	1536:CQGllrIdcGuzZc94cVM7gDX4NIGOI67Sy+xzn1:I6cvz+9IgDX4NIGOI6Sn1
MD5:	F495D1897A1B52A2B15C20DCECB84B47
SHA1:	8CB65590A8815BDA58C86613B6386B5982D9EC3F
SHA-256:	E47E76D70D508B62924FE480F30E615B12FDD7745C0AAC68A2CDDABD07B692AE
SHA-512:	725D408892887BEBD5BCF040A0ECC6A4E4B608815B9DEA5B6F7B95C812715F82079896DF33B0830C9F787FFE149B8182E529BB1F78AADD89DF264CF8853EE4C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........u...&...&...&.U&...&u..'...&u..'...&u..'...&u..'...&...'...&...'...&...&M..&...'...&...'...&..9&...&...'...&Rich...&........PE..d......e.........." ...#.R...~.......>..............................................'.....`.............................................P.............................../......X....\|..T............................{..@............p..(............................text...7P.......R.................. ..`.rdata...N...p...P...V..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159512
Entropy (8bit):	6.841828996170163
Encrypted:	false
SSDEEP:	3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
MD5:	4E2239ECE266230ECB231B306ADDE070
SHA1:	E807A078B71C660DB10A27315E761872FFD01443
SHA-256:	34130D8ABE27586EE315262D69AF4E27429B7EAB1F3131EA375C2BB62CF094BE
SHA-512:	86E6A1EAB3529E600DD5CAAB6103E34B0F618D67322A5ECF1B80839FAA028150C492A5CF865A2292CC8584FBA008955DA81A50B92301583424401D249C5F1401
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........TB#.5,p.5,p.5,p.M.p.5,p.I-q.5,p.I)q.5,p.I(q.5,p.I/q.5,pnH-q.5,p.M-q.5,p.5-p.5,pnH!q.5,pnH,q.5,pnH.p.5,pnH.q.5,pRich.5,p........PE..d......e.........." ...#.d..........06....................................................`......................................... %..L...l%..x....p.......P.......@.../......4.......T...........................p...@............................................text...:b.......d.................. ..`.rdata..............h..............@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35096
Entropy (8bit):	6.456173627081832
Encrypted:	false
SSDEEP:	768:VAIvrenSE0PkA9c0ji+m9IGWte5YiSyv2pAAMxkEn:6ITQSH9c0jlm9IGWtU7SyOOxj
MD5:	811BCEE2F4246265898167B103FC699B
SHA1:	AE3DE8ACBA56CDE71001D3796A48730E1B9C7CCE
SHA-256:	FB69005B972DC3703F9EF42E8E0FDDF8C835CB91F57EF9B6C66BBDF978C00A8C
SHA-512:	1F71E23CE4B6BC35FE772542D7845DCBEA2A34522BA0468B61CB05F9ABAB7732CBF524BCFF498D1BD0B13B5E8A45C373CCA19AD20E5370F17259E281EDF344BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........)*.wGy.wGy.wGy...y.wGy'.Fx.wGy'.Bx.wGy'.Cx.wGy'.Dx.wGyA.Fx.wGy.wFy.wGy..Fx.wGyA.Jx.wGyA.Gx.wGyA..y.wGyA.Ex.wGyRich.wGy........................PE..d...W..e.........." ...#.....>......P.....................................................`.........................................0E..`....E..x............p.......Z.../...........4..T............................3..@............0...............................text............................... ..`.rdata..r ...0..."..."..............@..@.data........`.......D..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55576
Entropy (8bit):	6.3454178187323755
Encrypted:	false
SSDEEP:	1536:2ND3ua5sIRL9EiqXxpNdtrtBIGXtz7SyNxM:2NjOiUpNdPBIGXtzi
MD5:	F9C67280538408411BE9A7341B93B5B0
SHA1:	CCF776CD2483BC83B48B1DB322D7B6FCAB48356E
SHA-256:	5D298BB811037B583CFF6C88531F1742FAE5EEE47C290ADB47DDBD0D6126B9CC
SHA-512:	AF2156738893EF504D582ACE6750B25BC42AD1EC8A92E0550CE54810706D854F37A82F38EB965A537CAD5D35C0178C5EB7B4D20DB2A95BEBFECF9A13C0592646
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|!{X.O(X.O(X.O(Qe.(\.O(.aN)Z.O(.aJ)T.O(.aK)P.O(.aL)[.O(.`N)Z.O(X.N(/.O(.eN)].O(.eK)Y.O(.`B)Y.O(.`O)Y.O(.`.(Y.O(.`M)Y.O(RichX.O(................PE..d...V..e.........." ...#.L...`......P...............................................wC....`.............................................X...X............................/......(....f..T...........................`e..@............`...............................text....J.......L.................. ..`.rdata..D8...`...:...P..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.464181935983508
Encrypted:	false
SSDEEP:	768:/k+Ea6rfMkAYY0J/MpIGQUG5YiSyvHAMxkEJ5YSv:8tfHY0JEpIGQU87SyPx/Y+
MD5:	6E00E0821BB519333CCFD4E61A83CB38
SHA1:	3550A41BB2EA54F456940C4D1940ACAB36815949
SHA-256:	2AD02D49691A629F038F48FCDEE46A07C4FCC2CB0620086E7B09AC11915AE6B7
SHA-512:	C3F8332C10B58F30E292676B48ECF1860C5EF9546367B87E90789F960C91EAE4D462DD3EE9CB14F603B9086E81B6701AAB56DA5B635B22DB1E758ED0A983E562
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:W\.[9..[9..[9..#...[9..'8..[9..'<..[9..'=..[9..':..[9..&8..[9.M#8..[9..[8.M[9..&4..[9..&9..[9..&...[9..&;..[9.Rich.[9.........................PE..d...Y..e.........." ...#.....8.......................................................a....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83224
Entropy (8bit):	6.340320871656589
Encrypted:	false
SSDEEP:	1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
MD5:	899380B2D48DF53414B974E11BB711E3
SHA1:	F1D11F7E970A7CD476E739243F8F197FCB3AD590
SHA-256:	B38E66E6EE413E5955EF03D619CADD40FCA8BE035B43093D2342B6F3739E883E
SHA-512:	7426CA5E7A404B9628E2966DAE544F3E8310C697145567B361825DC0B5C6CD87F2CAF567DEF8CD19E73D68643F2F38C08FF4FF0BB0A459C853F241B8FDF40024
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J./.+z\|.+z\|.+z\|.S.\|.+z\|.W{}.+z\|.W.}.+z\|.W~}.+z\|.Wy}.+z\|}V{}.+z\|.+{\|.+z\|.S{}.+z\|}Vw}.+z\|}Vz}.+z\|}V.\|.+z\|}Vx}.+z\|Rich.+z\|................PE..d......e.........." ...#.v...........-.......................................`...........`.............................................P............@.......0.........../...P..........T...............................@............................................text....u.......v.................. ..`.rdata...x.......z...z..............@..@.data...H...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124696
Entropy (8bit):	6.2652662506859444
Encrypted:	false
SSDEEP:	3072:fZIPlR6TxhNO7/9CO4w5yIFGcXcpVNIGOQyl:RjFHO7kC56cXuo
MD5:	CEE93C920951C1169B615CB6330CEDDA
SHA1:	EF2ABF9F760DB2DE0BD92AFE8766A0B798CF8167
SHA-256:	FF25BDBEEF34D2AA420A79D3666C2660E7E3E96259D1F450F1AF5268553380EC
SHA-512:	999D324448BB39793E4807432C697F01F8922B0ABA4519A21D5DC4F4FC8E9E4737D7E104B205B931AF753EDA65F61D0C744F12BE84446F9C6CB3C2A5B35B773C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@.g...g...g.......g..../..g......g....+..g....*..g....-..g..q./..g..../..g...g/..f..q.#..g..q....g..q...g..q.,..g..Rich.g..........PE..d......e.........." ...#.............................................................-....`.........................................po..P....o..................8......../.......... ...T...............................@............................................text............................... ..`.rdata..............................@..@.data...8............\|..............@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177432
Entropy (8bit):	5.975354635226847
Encrypted:	false
SSDEEP:	3072:KXGEr/16/nJxNOJW5NT6X3l44K5WOSCSVRJNI7IM/cbP7RHs3J7VIGC7hN:Y/r/16/nDNPT6X3l1CMVS7i
MD5:	9B4E74FD1DE0F8A197E4AA1E16749186
SHA1:	833179B49EB27C9474B5189F59ED7ECF0E6DC9EA
SHA-256:	A4CE52A9E0DADDBBE7A539D1A7EDA787494F2173DDCC92A3FAF43B7CF597452B
SHA-512:	AE72B39CB47A859D07A1EE3E73DE655678FE809C5C17FFD90797B5985924DDB47CEB5EBE896E50216FB445526C4CBB95E276E5F3810035B50E4604363EB61CD4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.k.4.8.4.8.4.8.L)8.4.8.H.9.4.8.H.9.4.8.H.9.4.8.H.9.4.8kI.9.4.8.4.8#5.8.L.9.4.8kI.9.4.8kI.9.4.8kIE8.4.8kI.9.4.8Rich.4.8........................PE..d......e.........." ...#............\,....................................................`......................................... ...d.......................8......../......x...@...T...............................@............................................text.............................. ..`.rdata...!......."..................@..@.data...(...........................@....pdata..8............^..............@..@.rsrc................j..............@..@.reloc..x............t..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25368
Entropy (8bit):	6.6272949891352315
Encrypted:	false
SSDEEP:	384:lrfwHnEWGQiAQVIGZwJXHQIYiSy1pCQ4XAM+o/8E9VF0NyqzJSj:dQnEIHQVIGZw95YiSyv8AMxkEqw
MD5:	3C8737723A903B08D5D718336900FD8C
SHA1:	2AD2D0D50F6B52291E59503222B665B1823B0838
SHA-256:	BB418E91E543C998D11F9E65FD2A4899B09407FF386E059A88FE2A16AED2556B
SHA-512:	1D974EC1C96E884F30F4925CC9A03FB5AF78687A267DEC0D1582B5D7561D251FB733CF733E0CC00FAEE86F0FEF6F73D36A348F3461C6D34B0238A75F69320D10
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<p.R#.R#.R#...#.R#i.S".R#i.W".R#i.V".R#i.Q".R#..S".R#..S".R#.S#..R#..Z".R#..R".R#...#.R#..P".R#Rich.R#........................PE..d...]..e.........." ...#.....&...... ........................................p......wz....`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36632
Entropy (8bit):	6.364173312940401
Encrypted:	false
SSDEEP:	768:PgMwnWGwMtUTA7LlVIGCilx5YiSyvzAMxkEaFy:PgMwWGJtGA7LlVIGCih7Syrx+g
MD5:	EE33F4C8D17D17AD62925E85097B0109
SHA1:	8C4A03531CF3DBFE6F378FDAB9699D51E7888796
SHA-256:	79ADCA5037D9145309D3BD19F7A26F7BB7DA716EE86E01073C6F2A9681E33DAD
SHA-512:	60B0705A371AD2985DB54A91F0E904EEA502108663EA3C3FB18ED54671BE1932F4F03E8E3FD687A857A5E3500545377B036276C69E821A7D6116B327F5B3D5C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._\...=.@.=.@.=.@.En@.=.@.A.A.=.@.A.A.=.@.A.A.=.@.@.A.=.@.A.A.=.@PE.A.=.@.=.@A=.@PE.A.=.@.@.A.=.@.@.A.=.@.@.@.=.@.@.A.=.@Rich.=.@........PE..d..._..e.........." ...#.(...:.......&....................................................`..........................................T..H....T...............p..`....`.../......t...DG..T............................C..@............@.......S..@....................text...>&.......(.................. ..`.rdata..D....@... ...,..............@..@.data........`.......L..............@....pdata..`....p.......P..............@..@.rsrc................T..............@..@.reloc..t............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_http_parser.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	264192
Entropy (8bit):	6.209859454972578
Encrypted:	false
SSDEEP:	6144:qV3aFwGtxiTjweCKvJ1+jLjJML5wir++JTCuG:qV3mxi3wDArolq5wiC
MD5:	40E99EAA1A21C1AA24F575855B52EEC0
SHA1:	0FE9B3B93F77D045B248C36BC5B5D5117C0176B3
SHA-256:	5F93DB706E799D00A3774CE14D078E272F8808867318C1183FDBE60D075D5F5D
SHA-512:	FAD6BF5BBCC7C54DC792A2AB9FAEFAB77DD15233BC86A566AB0B6F27128C0B0609D0E17469F373778A7122E5015D57AE8CA67BAD1D4BD47B92FCE95A47A7AA2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............zY..zY..zY...Y..zY.q{X..zY.v{X..zY.r{X..zY..{Y..zY.qyX..zY.q~X..zY.q.X..zYuqrX..zYuqzX..zYuq.Y..zYuqxX..zYRich..zY........................PE..d....H?g.........." ...*.(...........+....................................................`.........................................@...........x....`.......@..$............p..\...P...................................@............@...............................text....'.......(.................. ..`.rdata......@.......,..............@..@.data....@..........................@....pdata..$....@......................@..@.rsrc........`......................@..@.reloc..\....p......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_http_writer.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49664
Entropy (8bit):	5.798696651761287
Encrypted:	false
SSDEEP:	768:oPriCeqBiVwVJAQ8mK4fE0UYq0olSgEDmYgRE8tJQ:oprimVJtFxEqqAmYg20JQ
MD5:	1412E133574C3D73B77B4964A2A18FE3
SHA1:	240E4A6149FA4AFCE7E857D5544A2A0772F9C9EB
SHA-256:	9E33CAFEA557265EE254373F662ABCE9466952F0CCAE81F774A7F0D0CD34099F
SHA-512:	07C50CADDF6AE80E6CD30DD810F755656D6F6965DB0F9586FD9D339FB551D1F086209495B5AB69DF6339698F585372B4459F14D9AEBF316F4E242B2D0DBD0B94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..T:...:...:...3.].8...+d..8...Hc..8...+d..9...+d..2...+d..6...rg..9...:........d..;....d..;....d1.;....d..;...Rich:...........PE..d....H?g.........." ...*.z...........\|.......................................P............`............................................h...H...d....0....... ...............@......p...............................0...@...............P............................text....x.......z.................. ..`.rdata..20.......2...~..............@..@.data....N..........................@....pdata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_websocket\mask.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.654316966286352
Encrypted:	false
SSDEEP:	384:3FIKmzsyA2+kEyrMxA91WZqJ91cL9U0WJtqpTHl2zwu9L6lBw81eLaZ4Y1exetk0:3ehzcnygxA91bryrczTGbw8kLssqqTH
MD5:	1D59358DA065743D07FB455DE273A25E
SHA1:	82E99FF22B104ED0FE067A20C1B18C04B3155254
SHA-256:	148E0CFFDBCD02E3EB65A6BF2F2B9A8C45BC36C113D92CCDA40408A7D01A6DC9
SHA-512:	FE21A0010A543053919419FB31DD39E810F6EBAF1BC57DC5F89645F195901F354A57EA931AA464A208BB39C1AB0A7D1AC61D60D1B5F5EFED78570FAEC46B2DE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..T2...2...2...;.M.0...#d..0...@c..0...#d..1...#d..:...#d..>...zg..1...2........d..3....d..3....d!.3....d..3...Rich2...........................PE..d....H?g.........." ....N...B......`P....................................................`......................................... {..X...x{..d...................................0s...............................q..@............`...............................text....L.......N.................. ..`.rdata...)...`......R..............@..@.data................\|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\aiohttp\_websocket\reader_c.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	161792
Entropy (8bit):	6.09154494600188
Encrypted:	false
SSDEEP:	1536:WWN8oZXh2Y/m2/0+AMvRSDFxNYH/9Iw89qV406AgGkbJT0N6ctLU+XqiasgzvtaR:/GoVwY8M5bFIwoqRkYU0qikVXMNkqB
MD5:	5B741F2BCB063D276534D43979FC8945
SHA1:	7E4B63D4856BA1A720BD2CA68F0317B827E30886
SHA-256:	52009B3A55DC0721D7DD70A25C04CC714CE33A954EB2964AC47E527977EECF25
SHA-512:	A246CFAAC9C8D6F21C08EB9CF2F6D311747AF2F67EA6C38D6EE0C8C6CF8C78174425785C3F048038914DE1E93562697E6FEE435AFA5DF7372E0CE43DC67E72A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..E&...&...&.../.G."...7U..$...TR..$...7U.."...7U......7U.....nV..%...&........U..'....U..'....U+.'....U..'...Rich&...........PE..d....H?g.........." .....................................................................`......................................... N..`....N..x...............D...................`<.............................. ;..@............................................text............................... ..`.rdata...f.......h..................@..@.data...X$...p.......P..............@....pdata..D............f..............@..@.rsrc................t..............@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\attrs-24.2.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI72522\attrs-24.2.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	Unicode text, UTF-8 text, with very long lines (411)
Category:	dropped
Size (bytes):	11524
Entropy (8bit):	5.211520136058075
Encrypted:	false
SSDEEP:	192:ERsUfi6bkQk+k/kKkegToJWicnJsPVA1oz2dv7COmoKTACoEJdQ/0G6lWg+JdQV5:ERsXpLs3VoJWRnJsPvz2dDCHoKsLgA6z
MD5:	49CABCB5F8DA14C72C8C3D00ADB3C115
SHA1:	F575BECF993ECDF9C6E43190C1CB74D3556CF912
SHA-256:	DC9824E25AFD635480A8073038B3CDFE6A56D3073A54E1A6FB21EDD4BB0F207C
SHA-512:	923DAEEE0861611D230DF263577B3C382AE26400CA5F1830EE309BD6737EED2AD934010D61CDD4796618BEDB3436CD772D9429A5BED0A106EF7DE60E114E505C
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: attrs.Version: 24.2.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: GitHub, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Languag

C:\Users\user\AppData\Local\Temp\_MEI72522\attrs-24.2.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	3556
Entropy (8bit):	5.809424313364516
Encrypted:	false
SSDEEP:	96:Q9ewBtnJT/oPynEddwBbCobXm9qGmR5VXzskcGD+qLtxO:2ewnXJCKXGeR/XzKiO
MD5:	4B6973D2285295CF5E3A45E64EB7A455
SHA1:	1089F2F3C35303D6D5DD19F0C0F707B9609EE3F2
SHA-256:	2B368DFC37283970C33CC8D4EEC129F668EB99EBF9D3AA27F49A1B149658F2B0
SHA-512:	A5150ECB625A3CFDC3F22C60EB7B16FDBED01CD47505BD520491B477AE24E8C59FFAE2334948122E656F6F0A5F2AF0635B6D976241745583A3D7AF9E3781718D
Malicious:	false
Preview:	attr/__init__.py,sha256=l8Ewh5KZE7CCY0i1iDfSCnFiUTIkBVoqsXjX9EZnIVA,2087..attr/__init__.pyi,sha256=aTVHBPX6krCGvbQvOl_UKqEzmi2HFsaIVm2WKmAiqVs,11434..attr/__pycache__/__init__.cpython-312.pyc,,..attr/__pycache__/_cmp.cpython-312.pyc,,..attr/__pycache__/_compat.cpython-312.pyc,,..attr/__pycache__/_config.cpython-312.pyc,,..attr/__pycache__/_funcs.cpython-312.pyc,,..attr/__pycache__/_make.cpython-312.pyc,,..attr/__pycache__/_next_gen.cpython-312.pyc,,..attr/__pycache__/_version_info.cpython-312.pyc,,..attr/__pycache__/converters.cpython-312.pyc,,..attr/__pycache__/exceptions.cpython-312.pyc,,..attr/__pycache__/filters.cpython-312.pyc,,..attr/__pycache__/setters.cpython-312.pyc,,..attr/__pycache__/validators.cpython-312.pyc,,..attr/_cmp.py,sha256=3umHiBtgsEYtvNP_8XrQwTCdFoZIX4DEur76N-2a3X8,4123..attr/_cmp.pyi,sha256=U-_RU_UZOyPUEQzXE6RMYQQcjkZRY25wTH99sN0s7MM,368..attr/_compat.py,sha256=n2Uk3c-ywv0PkFfGlvqR7SzDXp4NOhWmNV_ZK6YfWoM,2958..attr/_config.py,sha256=z81Vt-GeT_2taxs1XZfmHx9TWlSxjP

C:\Users\user\AppData\Local\Temp\_MEI72522\attrs-24.2.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.730668933656452
Encrypted:	false
SSDEEP:	3:RtEeXAaCTQnP+tPCCfA5I:Rt2PcnWBB3
MD5:	52ADFA0C417902EE8F0C3D1CA2372AC3
SHA1:	B67635615EEF7E869D74F4813B5DC576104825DD
SHA-256:	D7215D7625CC9AF60AED0613AAD44DB57EBA589D0CCFC3D8122114A0E514C516
SHA-512:	BFA87E7B0E76E544C2108EF40B9FAC8C5FF4327AB8EDE9FEB2891BD5D38FEA117BD9EEBAF62F6C357B4DEADDAD5A5220E0B4A54078C8C2DE34CB1DD5E00F2D62
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: hatchling 1.25.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI72522\attrs-24.2.0.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.104415762129373
Encrypted:	false
SSDEEP:	24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
MD5:	5E55731824CF9205CFABEAB9A0600887
SHA1:	243E9DD038D3D68C67D42C0C4BA80622C2A56246
SHA-256:	882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
SHA-512:	21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Users\user\AppData\Local\Temp\_MEI72522\base_library.zip

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1329520
Entropy (8bit):	5.586627513342047
Encrypted:	false
SSDEEP:	12288:uttcY+b+2OGgRF1+fYNXPh26UZWAzCu7jqD9KwdgkVDdYuP0whsA9gCCaYchQ:uttcY+PnCiCAqoNqDdYuPVzEaYchQ
MD5:	9B3C32B54CF69405030D2F787FB0C7DF
SHA1:	B2D906EF86EECEB934E84ACA6985599854B70AE1
SHA-256:	7A55058782C4FEBED8EA12B4CAFF9257ED22F22B3E25BA80593E4265A1E099E8
SHA-512:	40ABBAFA11E80E83514DB17342B0271C4FD23C2380EC7BCAE97F318101561EF64F964BAEC7A6D2AD74111572473C6A728277CEBDEA8BDBEC3192D6A0A958A462
Malicious:	false
Preview:	PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI72522\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI72522\charset_normalizer\md.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.817893239381772
Encrypted:	false
SSDEEP:	192:MRv9XFCk2z1/t12iwU5usJFcCyD9cqgE:aVVC5djuUFJKtgE
MD5:	71D96F1DBFCD6F767D81F8254E572751
SHA1:	E70B74430500ED5117547E0CD339D6E6F4613503
SHA-256:	611E1B4B9ED6788640F550771744D83E404432830BB8E3063F0B8EC3B98911AF
SHA-512:	7B10E13B3723DB0E826B7C7A52090DE999626D5FA6C8F9B4630FDEEF515A58C40660FA90589532A6D4377F003B3CB5B9851E276A0B3C83B9709E28E6A66A1D32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d... $.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	5.935676608756784
Encrypted:	false
SSDEEP:	1536:BETt3OiaqGB7QNX6Pq4a461TDqFRgMzrOH+d3gdy2iIeP/j3bhouROm:Bmt+is7QNqP1ab1TGb9g/iI4bhouROm
MD5:	D8F690EAE02332A6898E9C8B983C56DD
SHA1:	112C1FE25E0D948F767E02F291801C0E4AE592F0
SHA-256:	C6BB8CAD80B8D7847C52931F11D73BA64F78615218398B2C058F9B218FF21CA9
SHA-512:	E732F79F39BA9721CC59DBE8C4785FFD74DF84CA00D13D72AFA3F96B97B8C7ADF4EA9344D79EE2A1C77D58EF28D3DDCC855F3CB13EDDA928C17B1158ABCC5B4A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........yB....................7...............7.......7.......7.......6..........C....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........B.......................................0............`.............................................d.................................... ......@...................................@............P...............................text....>.......@.................. ..`.rdata..PY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	5.074230645519915
Encrypted:	false
SSDEEP:	96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
MD5:	C891CD93024AF027647E6DE89D0FFCE2
SHA1:	01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
SHA-256:	EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
SHA-512:	3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15579
Entropy (8bit):	5.5664904316569785
Encrypted:	false
SSDEEP:	192:1XeTBL1z5jF4E9VqhXJZ4WPB6s7B0Ppz+NX6in5Lqw/I+B:1XkL1hCEsJrPB6s7B0Ppz+96innVB
MD5:	4DECFB7B4491D572BFEF7359B48F44FC
SHA1:	A4A4D4BF35021D7402922CA58E1E29AE564524FD
SHA-256:	2538AB429E324FDDEAC70C8C511E24E9FAF5DC8D531D910B1A6FF17C13C5D536
SHA-512:	CE05550E47B778EAB691191A9B08C53F4BE8C3F371C5831B901D17535237A45E46F8362A1BC365DBDEF45FF7AFF475EAA4517FB43F715A4F92481F014EF2E18F
Malicious:	false
Preview:	cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-312.pyc,,..cryptography/__pycache__/__ini

C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.016084900984752
Encrypted:	false
SSDEEP:	3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
MD5:	C869D30012A100ADEB75860F3810C8C9
SHA1:	42FD5CFA75566E8A9525E087A2018E8666ED22CB
SHA-256:	F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
SHA-512:	B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info\license_files\LICENSE

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI72522\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7834624
Entropy (8bit):	6.517862303223651
Encrypted:	false
SSDEEP:	49152:oFNZj7fIo9W67PapgzJTkrXyzNzpXAbuiqCgIns3mYEXEqMrIU6i7GtlqdVwASO/:QI9X/gIFYEXME+oFNr5VQCJheq4BsxH
MD5:	BFD28B03A4C32A9BCB001451FD002F67
SHA1:	DD528FD5F4775E16B2E743D3188B66F1174807B2
SHA-256:	8EF0F404A8BFF12FD6621D8F4F209499613F565777FE1C2A680E8A18F312D5A7
SHA-512:	6DC39638435F147B399826E34F78571D7ED2ED1232275E213A2B020224C0645E379F74A0CA5DE86930D3348981C8BB03BBBECFA601F8BA781417E7114662DDEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..Y..$........W.......................................w...........`..........................................q.....l.q.............. s...............w......zi.T....................{i.(...Pyi.@.............Y..............................text...k.Y.......Y................. ..`.rdata...A....Y..B....Y.............@..@.data...@+....q.......q.............@....pdata....... s.......r.............@..@.reloc........w.......v.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\frozenlist\_frozenlist.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	5.9471652810047235
Encrypted:	false
SSDEEP:	1536:NIf505ZC316pwJV0Jzn4pyOJ8RMrpLkFb0GZi8fR3px7F:Q66gFlmrpLkFwGTp3pt
MD5:	5A5BD0B8845F5A47ECFC2C55ABE7413C
SHA1:	D4B2E85D30480573FEFBC413C4F7B81FA67115E1
SHA-256:	8BE6E6CC104018C0DC1AE0694330F44B94FABB6C50EEC086373DDF24117D78A7
SHA-512:	B2C24C3C5D59A4987F36DFCF677227C020BB632B7155E99D7405516BD855B03965F3FC3558E8637DA1B4E65E7EF7C5D2EA33B338BAEAE72F62017ED682D19651
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*.5VK.fVK.fVK.f_3DfRK.fF..gTK.f.3.gTK.fF..gUK.fF..g^K.fF..g[K.f...gUK.fVK.f.K.f...gWK.f...gWK.f..(fWK.f...gWK.fRichVK.f........PE..d.....g.........." ...).....v............................................................`..........................................7..h...x7..x............p..(....................&..............................P%..@...............@............................text............................... ..`.rdata...J.......L..................@..@.data...h....P.......6..............@....pdata..(....p.......D..............@..@.rsrc................P..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5162776
Entropy (8bit):	5.958207976652471
Encrypted:	false
SSDEEP:	98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
MD5:	51E8A5281C2092E45D8C97FBDBF39560
SHA1:	C499C810ED83AAADCE3B267807E593EC6B121211
SHA-256:	2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
SHA-512:	98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.\|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...\|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	790296
Entropy (8bit):	5.607732992846443
Encrypted:	false
SSDEEP:	6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
MD5:	BFC834BB2310DDF01BE9AD9CFF7C2A41
SHA1:	FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
SHA-256:	41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
SHA-512:	6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\multidict\_multidict.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.417086235508803
Encrypted:	false
SSDEEP:	768:67CE1/NMVzMoCQVbrw0k6To3OOG/B+jPSrSRNj4bSM2V:QruzMoNrNTo3OOG/eRF4be
MD5:	4EED96BBB1C4B6D63F50C433E9C0A16A
SHA1:	CDE34E8F1DAC7F4E98D2B0AAF1186C6938DE06C3
SHA-256:	B521B7E3B6BED424A0719C36735BC4BF2BB8B0926370B31C221C604E81F8D78B
SHA-512:	1CACB250D867FCBBC5224C3F66CB23A93F818BC1D0524CAD6D1C52295D243AF10F454FDE13FA58671D3EE62281A2A3F71A69F28B08FD942FCEDBA3C9B09A774A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v`.2...2...2...;y..0..."...0...yy..0..."...1..."...:..."...9...!...1...2...G...z...3...z...3...z.s.3...z...3...Rich2...................PE..d....}.f.........." ...).\...^...... `....................................................`.............................................d...$...d...............x...............,...................................P...@............p...............................text....[.......\.................. ..`.rdata...+...p...,...`..............@..@.data...."..........................@....pdata..x...........................@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\propcache\_helpers_c.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	75264
Entropy (8bit):	5.884143909360528
Encrypted:	false
SSDEEP:	1536:lqJRuicm7rbNAx366qHC2ajmjZ1mQpheRx/gF:lqJRuiTHpq5qi2amd1XpheRx/gF
MD5:	93CCD2B7284BDC745F1ADBB8F0927F26
SHA1:	30043D4DAD9A909B2D0841D279F5266F00315AD9
SHA-256:	C8C7C9259A47961321B6D913B3CB70215A37B9CFF1DBDE9E9CBC3250C1B5AD77
SHA-512:	1DD365345FF334183A1A4AD959EC07A732836D6F1768E935462F0EA62F24F50EE62FB1324FCD813EF7BC40ED092C33F5D5BF70B8D016B67BE9A9274DAD2868D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T........?..............................................W.................S.........Rich..........................PE..d...V..g.........." ...).....l...............................................p............`.............................................d.......d....P.......@...............`..T...@...................................@............................................text...H........................... ..`.rdata..*E.......F..................@..@.data........ ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc..T....`.......$..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.909456553599775
Encrypted:	false
SSDEEP:	1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
MD5:	49AC12A1F10AB93FAFAB064FD0523A63
SHA1:	3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
SHA-256:	BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
SHA-512:	1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..5..5..5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	200472
Entropy (8bit):	6.382659996286758
Encrypted:	false
SSDEEP:	3072:mhaQEuYCUDWuc7VmkqrgVrLJEKAAKJadAT0nIgjWdopPb/+mVApIGLhSZ:yaJh6v7VRVrLJEKAABiuXKd4GE
MD5:	F554064233C082F98EF01195693D967D
SHA1:	F191D42807867E0174DDC66D04C45250D9F6561E
SHA-256:	E1D56FFBF5E5FAB481D7A14691481B8FF5D2F4C6BF5D1A4664C832756C5942FE
SHA-512:	3573A226305CEC45333FC4D0E6FC0C3357421AD77CD8A1899C90515994351292EE5D1C445412B5563AA02520736E870A9EE879909CD992F5BE32E877792BDB88
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................g.................................h.......................h.......h.......h.......h.......Rich....................PE..d...Z..e.........." ...#............0...............................................2.....`.............................................P...`............................/..........P4..T............................3..@............ ...............................text.../........................... ..`.rdata..4.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\python3.dll

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68376
Entropy (8bit):	6.14883904573939
Encrypted:	false
SSDEEP:	768:3V1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/J:3DmF61JFn+/OipIGL0m7Sy0xG
MD5:	77896345D4E1C406EEFF011F7A920873
SHA1:	EE8CDD531418CFD05C1A6792382D895AC347216F
SHA-256:	1E9224BA7190B6301EF47BEFA8E383D0C55700255D04A36F7DAC88EA9573F2FB
SHA-512:	3E98B1B605D70244B42A13A219F9E124944DA199A88AD4302308C801685B0C45A037A76DED319D08DBF55639591404665BEFE2091F0F4206A9472FEE58D55C22
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."e.."e.."e.0_m.."e.0_e.."e.0_..."e.0_g.."e.Rich."e.................PE..d...@..e.........." ...#............................................................q.....`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\python312.dll

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6972184
Entropy (8bit):	5.774196030396665
Encrypted:	false
SSDEEP:	98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
MD5:	5C5602CDA7AB8418420F223366FFF5DB
SHA1:	52F81EE0AEF9B6906F7751FD2BBD4953E3F3B798
SHA-256:	E7890E38256F04EE0B55AC5276BBF3AC61392C3A3CE150BB5497B709803E17CE
SHA-512:	51C3B4F29781BB52C137DDB356E1BC5A37F3A25F0ED7D89416B14ED994121F884CB3E40CCDBB211A8989E3BD137B8DF8B28E232F98DE8F35B03965CFCE4B424F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................m.................x...s...x......x......x......Rich............PE..d...=..e.........." ...#..(..6B.....l........................................@k.......k...`......................................... .O.......O.......i......``..V...4j../....i..X.. I3.T....................7I.(....G3.@.............(..............................text...V.(.......(................. ..`.rdata...A'...(..B'...(.............@..@.data....4... P..x....O.............@....pdata...V...``..X...v_.............@..@PyRuntim......b.......a.............@....rsrc.........i.......h.............@..@.reloc...X....i..Z....h.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\pywin32_system32\pywintypes312.dll

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	136192
Entropy (8bit):	6.007891413043079
Encrypted:	false
SSDEEP:	3072:ZaklTxm5xclSlX8fY/r06Yr0UWm63ELUAXkXrT4:wklTxm5xAhY/rkwNm2E4AXk
MD5:	DA0E290BA30FE8CC1A44EEEFCF090820
SHA1:	D38FCCD7D6F54AA73BD21F168289D7DCE1A9D192
SHA-256:	2D1D60B996D1D5C56C24313D97E0FCDA41A8BD6BF0299F6EA4EB4A1E25D490B7
SHA-512:	BC031D61E5772C60CBAC282D05F76D81AF1AA2A29A8602C2EFA05FC0CE1079390999336237560B408E6539A77C732F5066C1590B7FEAEDB24BAA9371783F2A8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.I+.z'x.z'x.z'x...x.z'xW.&y.z'xc..x.z'xW."y.z'xW.#y.z'xW.$y.z'xN.#y.z'xM.&y.z'xN.&y.z'x.z&x.z'x...y.z'x..'y.z'x..%y.z'xRich.z'x................PE..d......g.........." .........................................................`............`.........................................0...lB......,....@..l.... ...............P..0....a..T............................b..8............................................text...I........................... ..`.rdata..(...........................@..@.data....-.......(..................@....pdata....... ......................@..@.rsrc...l....@......................@..@.reloc..0....P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\select.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	6.531624163477087
Encrypted:	false
SSDEEP:	768:s7ENJKHq1vv38pIGQGE5YiSyvTcAMxkEMrX:s7ENJKK1vv38pIGQGO7Syb6xuX
MD5:	BFFFF83A000BAF559F3EB2B599A1B7E8
SHA1:	7F9238BDA6D0C7CC5399C6B6AB3B42D21053F467
SHA-256:	BC71FBDFD1441D62DD86D33FF41B35DC3CC34875F625D885C58C8DC000064DAB
SHA-512:	3C0BA0CF356A727066AE0D0D6523440A882AAFB3EBDF70117993EFFD61395DEEBF179948F8C7F5222D59D1ED748C71D9D53782E16BD2F2ECCC296F2F8B4FC948
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.q\|'.q\|'.q\|'...'.q\|'q.}&.q\|'q.y&.q\|'q.x&.q\|'q..&.q\|'..}&.q\|'.q}'.q\|'..}&.q\|'..q&.q\|'..\|&.q\|'...'.q\|'..~&.q\|'Rich.q\|'........PE..d...Z..e.........." ...#.....2............................................................`..........................................@..L...,A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text...v........................... ..`.rdata.......0......................@..@.data........P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	5.006900644756252
Encrypted:	false
SSDEEP:	96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
MD5:	98ABEAACC0E0E4FC385DFF67B607071A
SHA1:	E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
SHA-256:	6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
SHA-512:	F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.6307766747793275
Encrypted:	false
SSDEEP:	48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
MD5:	EB513CAFA5226DDA7D54AFDCC9AD8A74
SHA1:	B394C7AEC158350BAF676AE3197BEF4D7158B31C
SHA-256:	0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
SHA-512:	A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
Malicious:	false
Preview:	importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.687870576189661
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
MD5:	7D09837492494019EA51F4E97823D79F
SHA1:	7829B4324BB542799494131A270EC3BDAD4DEDEF
SHA-256:	9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
SHA-512:	A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text, with very long lines (888)
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.226823573023539
Encrypted:	false
SSDEEP:	24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
MD5:	4CE7501F6608F6CE4011D627979E1AE4
SHA1:	78363672264D9CD3F72D5C1D3665E1657B1A5071
SHA-256:	37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
SHA-512:	A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
Malicious:	false
Preview:	Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI72522\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI72522\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1504024
Entropy (8bit):	6.578874733366613
Encrypted:	false
SSDEEP:	24576:95WQyUuqjJVKMXijWRwtHHofIyEcL/2m75i5zxHWc9C08lY8ore60hH:9b0yVKMyjWR6nofQm7U59HWKYY8
MD5:	82EA0259009FF75BBA817BD8C15C7588
SHA1:	04C49687D8241B43AE61A6C59299255EF09A7B39
SHA-256:	8AA8B909A39FCC33D1EC2AD51EAC6714A318C6EFD04F963D21B75D8F64809AD6
SHA-512:	1F8B3343898462E385D25E1820A3D7D971D633933E482EA9FFC596E7E1F902F5657A9F2C104CF320EEEF34CCE814261304E2E1C063BE4C6A807ADC9B75F3E670
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W..W..W..^.P.[....U....Z...._.....S.....T..W........V.....V....<.V......V..RichW..........................PE..d......e.........." ...#..................................................................`.........................................Px...".............................../...........*..T............................(..@...............8............................text............................... ..`.rdata..............................@..@.data...PG.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1137944
Entropy (8bit):	5.462221778372869
Encrypted:	false
SSDEEP:	12288:IFrEHdcM6hbZCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfctZq:IFrEXcCjfk7bPNfv42BN6yzUtZq
MD5:	A1388676824CE6347D31D6C6A7A1D1B5
SHA1:	27DD45A5C9B7E61BB894F13193212C6D5668085B
SHA-256:	2480A78815F619A631210E577E733C9BAFECB7F608042E979423C5850EE390FF
SHA-512:	26EA1B33F14F08BB91027E0D35AC03F6203B4DFEEE602BB592C5292AB089B27FF6922DA2804A9E8A28E47D4351B32CF93445D894F00B4AD6E2D0C35C6C7F1D89
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3m..3m..3m..:...5m......1m......>m......;m......0m......0m..x...1m..3m..cm......2m......2m....j.2m......2m..Rich3m..................PE..d...]..e.........." ...#.>..........`*.......................................p.......%....`.........................................p...X............P.......@.........../...`......P^..T............................]..@............P..p............................text....=.......>.................. ..`.rdata..\....P.......B..............@..@.data...X.... ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.874056262688227
Encrypted:	false
SSDEEP:	3072:LqnAWHjDQCj8ilDiv+zQQoMlRVFhLaNzvvA5sqQvml1RhkmrAte:L1ojDHjllCrMlRVgvY5sqQeRhkmrA
MD5:	E9D8AB0E7867F5E0D40BD474A5CA288C
SHA1:	E7BDF1664099C069CEEA18C2922A8DB049B4399A
SHA-256:	DF724F6ABD66A0549415ABAA3FDF490680E6E0CE07584E964B8BFD01E187B487
SHA-512:	49B17E11D02AE99583F835B8ECF526CF1CF9CEAB5D8FAC0FBFAF45411AC43F0594F93780AE7F6CB3EBBC169A91E81DD57A37C48A8CD5E2653962FFBDCF9879BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V.........................................+..........................................Rich...........PE..d...!..g.........." .........................................................P............`......................................... ................0..\.......X............@..X....v..T............................;..8............0..........@....................text............................... ..`.rdata..2....0......................@..@.data...X(......."..................@....pdata..X...........................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI72522\yarl\_quoting_c.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\lz4wnSavmK.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	6.009362786457499
Encrypted:	false
SSDEEP:	1536:hA6zeuPEpCbl4DlaAw/AlDNTXBUhF5dYLprRD0WcpipPmlK:hA6jPEUbOwajI5dsOWcpipPe
MD5:	34BEE8FDC3AB28504FE568D886F846DA
SHA1:	C43EE4ADBE83571E17867DD277DD18CB42E1A6B7
SHA-256:	B4C2ADF4BD70A41C0CBB6D1296303AB66169CD52633F514164E755711F0648FB
SHA-512:	1C1013B0EF7D7BA3B01D7CA19A06F808234F3E51C1346AAC57641D2FCC03B4F4E129066D17135F91E56D3092E18FFF77740D4B5E323B5E670ADB8B3E69BDF36C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........].......................................................................^.....................F.............Rich............................PE..d....@?g.........." .....................................................................`.........................................0X..d....X..x...............................,...0H...............................F..@............ ...............................text............................... ..`.rdata...M... ...N..................@..@.data....6...p.......`..............@....pdata...............l..............@..@.rsrc................x..............@..@.reloc..,............z..............@..B................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.996812332992611
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	lz4wnSavmK.exe
File size:	18'082'384 bytes
MD5:	751a7a40b57d187a0b51d92c550e1309
SHA1:	70e2bea90cf8571b803d18cfaf3bbe671f4de515
SHA256:	fdbefb2cfbcddbae6f870be9c5bf65266f8775e61422b24bbab0bf36555139ff
SHA512:	b5fbf68fc4b8f96340bd338117e3e3db718c5b933cee086000b63900d45ba358467a44fc725aabca65ea97455caaaee47e1b77d728ff434fae5b3f34b7faacf4
SSDEEP:	393216:k9Yi54urLe63hucnW+eGQRn9josCBGcZvW7JTXN6u6K2:k9Yi5Rr73hrnW+e5Rn9MVa96u6p
TLSH:	C9073398E5D85CC5D4F2993FD8E68107DA73FC1117A0CE8B57B8A5A31EA71C44A3EE20
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000ce20
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6744D918 [Mon Nov 25 20:07:52 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F166CB3C08Ch
dec eax
add esp, 28h
jmp 00007F166CB3BCAFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F166CB3C458h
test eax, eax
je 00007F166CB3BE53h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F166CB3BE37h
dec eax
cmp ecx, eax
je 00007F166CB3BE46h
xor eax, eax
dec eax
cmpxchg dword ptr [0003570Ch], ecx
jne 00007F166CB3BE20h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F166CB3BE29h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F166CB3BE39h
mov byte ptr [000356F5h], 00000001h
call 00007F166CB3B585h
call 00007F166CB3C870h
test al, al
jne 00007F166CB3BE36h
xor al, al
jmp 00007F166CB3BE46h
call 00007F166CB4938Fh
test al, al
jne 00007F166CB3BE3Bh
xor ecx, ecx
call 00007F166CB3C880h
jmp 00007F166CB3BE1Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000356BCh], 00000000h
mov ebx, ecx
jne 00007F166CB3BE99h
cmp ecx, 01h
jnbe 00007F166CB3BE9Ch
call 00007F166CB3C3CEh
test eax, eax
je 00007F166CB3BE5Ah
test ebx, ebx
jne 00007F166CB3BE56h
dec eax
lea ecx, dword ptr [000356A6h]
call 00007F166CB49182h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca34	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2238	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f70	0x2a000	b8c3814c5fb0b18492ad4ec2ffe0830a	False	0.5518740699404762	data	6.489205819736506	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a28	0x12c00	28cdd4013c326d828bde8c517f5f8e1e	False	0.5242838541666667	data	5.7507632215498985	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2238	0x2400	9cd1eac931545f28ab09329f8bfce843	False	0.4697265625	data	5.2645170849678795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0xf41c	0xf600	455788c285fcfdcb4008bc77e762818a	False	0.803099593495935	data	7.5549760623589695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x47208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x480b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x48958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x48ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x523ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x54994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x55a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x55ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x55f0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 17:48:03.683763027 CET	49731	80	192.168.2.4	163.5.242.208
Dec 6, 2024 17:48:03.803580046 CET	80	49731	163.5.242.208	192.168.2.4
Dec 6, 2024 17:48:03.803917885 CET	49731	80	192.168.2.4	163.5.242.208
Dec 6, 2024 17:48:03.804020882 CET	49731	80	192.168.2.4	163.5.242.208
Dec 6, 2024 17:48:03.923974037 CET	80	49731	163.5.242.208	192.168.2.4
Dec 6, 2024 17:48:05.159075022 CET	80	49731	163.5.242.208	192.168.2.4
Dec 6, 2024 17:48:05.160017967 CET	49731	80	192.168.2.4	163.5.242.208
Dec 6, 2024 17:48:05.161467075 CET	49732	80	192.168.2.4	163.5.242.208
Dec 6, 2024 17:48:05.281426907 CET	80	49731	163.5.242.208	192.168.2.4
Dec 6, 2024 17:48:05.281497955 CET	49731	80	192.168.2.4	163.5.242.208
Dec 6, 2024 17:48:05.282500029 CET	80	49732	163.5.242.208	192.168.2.4
Dec 6, 2024 17:48:05.282578945 CET	49732	80	192.168.2.4	163.5.242.208
Dec 6, 2024 17:48:05.282717943 CET	49732	80	192.168.2.4	163.5.242.208
Dec 6, 2024 17:48:05.402549028 CET	80	49732	163.5.242.208	192.168.2.4
Dec 6, 2024 17:48:06.622507095 CET	80	49732	163.5.242.208	192.168.2.4
Dec 6, 2024 17:48:06.629486084 CET	49732	80	192.168.2.4	163.5.242.208
Dec 6, 2024 17:48:06.750176907 CET	80	49732	163.5.242.208	192.168.2.4
Dec 6, 2024 17:48:06.750236988 CET	49732	80	192.168.2.4	163.5.242.208

HTTP Request Dependency Graph

163.5.242.208

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	163.5.242.208	80	7300	C:\Users\user\Desktop\lz4wnSavmK.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:48:03.804020882 CET	160	OUT	GET /qweqwe_token.txt HTTP/1.1 Host: 163.5.242.208 User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive
Dec 6, 2024 17:48:05.159075022 CET	354	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:48:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Mon, 25 Nov 2024 18:43:53 GMT ETag: "2e-627c11d47037f" Accept-Ranges: bytes Content-Length: 46 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 37 35 35 31 39 34 37 38 33 38 3a 41 41 46 39 39 46 76 4d 66 68 39 73 6f 54 70 55 77 61 68 55 35 75 63 44 30 54 49 59 57 6d 6c 58 77 74 6f Data Ascii: 7551947838:AAF99FvMfh9soTpUwahU5ucD0TIYWmlXwto

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	163.5.242.208	80	7300	C:\Users\user\Desktop\lz4wnSavmK.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 17:48:05.282717943 CET	165	OUT	GET /5626872516_chatid.txt HTTP/1.1 Host: 163.5.242.208 User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive
Dec 6, 2024 17:48:06.622507095 CET	317	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:48:06 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Mon, 25 Nov 2024 20:06:35 GMT ETag: "a-627c2450d9b8d" Accept-Ranges: bytes Content-Length: 10 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 35 36 32 36 38 37 32 35 31 36 Data Ascii: 5626872516

Target ID:	0
Start time:	11:47:55
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\lz4wnSavmK.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\lz4wnSavmK.exe"
Imagebase:	0x7ff77c630000
File size:	18'082'384 bytes
MD5 hash:	751A7A40B57D187A0B51D92C550E1309
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:47:58
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\lz4wnSavmK.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\lz4wnSavmK.exe"
Imagebase:	0x7ff77c630000
File size:	18'082'384 bytes
MD5 hash:	751A7A40B57D187A0B51D92C550E1309
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	61

Executed Functions

Function 00007FF77C638BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF77C639400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF77C6345E4,00000000,00007FF77C631985), ref: 00007FF77C639439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638C46

Part of subcall function 00007FF77C64A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64A500

Part of subcall function 00007FF77C64878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6487F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638CD6
CreateProcessW.KERNELBASE ref: 00007FF77C638D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638D18

Part of subcall function 00007FF77C632C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C633706,?,00007FF77C633804), ref: 00007FF77C632C9E
Part of subcall function 00007FF77C632C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C633706,?,00007FF77C633804), ref: 00007FF77C632D63
Part of subcall function 00007FF77C632C50: MessageBoxW.USER32 ref: 00007FF77C632D99

RegisterClassW.USER32 ref: 00007FF77C638D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638D7B
CreateWindowExW.USER32 ref: 00007FF77C638DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638E05
PeekMessageW.USER32 ref: 00007FF77C638E29
TranslateMessage.USER32 ref: 00007FF77C638E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638E41
PeekMessageW.USER32 ref: 00007FF77C638E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638FF4
GetExitCodeProcess.KERNELBASE ref: 00007FF77C639009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C639012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C63901F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF77C638D44
CreateProcessW, xrefs: 00007FF77C638D27
PyInstaller Onefile Hidden Window, xrefs: 00007FF77C638D85
Failed to create child process!, xrefs: 00007FF77C638D20

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: 421c7c3c72bc51a63a2a49f968326013d82f4217dc18b445872b84f441ee1f53
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: CFD16133B38A8286E711AF34E8942ABB762FF8CB58F900235DE5D96694DF3CD5458710

Function 00007FF77C631000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF77C633A17, 00007FF77C633A2F, 00007FF77C633A9B
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF77C633E0A
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF77C633EBB
pkg, xrefs: 00007FF77C6339BE
Could not create temporary directory!, xrefs: 00007FF77C633CBF
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF77C633D12
pyi-runtime-tmpdir, xrefs: 00007FF77C633B68
Failed to start splash screen!, xrefs: 00007FF77C633ED4
pyi-contents-directory, xrefs: 00007FF77C633B8D
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF77C633C61
Failed to load splash screen resources!, xrefs: 00007FF77C633E85
MEI, xrefs: 00007FF77C633933
pyi-python-flag, xrefs: 00007FF77C633AD6
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF77C633A0B, 00007FF77C633CD4, 00007FF77C633F6B
VCRUNTIME140.dll, xrefs: 00007FF77C633DB1
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF77C6339DE
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF77C633882, 00007FF77C6338AF
Failed to remove temporary directory: %s, xrefs: 00007FF77C633FC3
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF77C633EA6
Py_GIL_DISABLED, xrefs: 00007FF77C633AF4
_PYI_SPLASH_IPC, xrefs: 00007FF77C633A23, 00007FF77C633EF5
_PYI_ARCHIVE_FILE, xrefs: 00007FF77C6338D2, 00007FF77C6339FF
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF77C633B32
Failed to convert DLL search path!, xrefs: 00007FF77C633DDC
pyi-disable-windowed-traceback, xrefs: 00007FF77C633BB2
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF77C633971
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF77C633D35
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF77C633BE8

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 0e7f9f8f9b7973c5112ddf8e6b7b04449a78dc6e1f1e844403fce0d1da25eb6d
Instruction ID: 9114c02e35f4c945f3e564d6bb4ac957497460a2e6caa7a6b363cd5af0fa4c48
Opcode Fuzzy Hash: 0e7f9f8f9b7973c5112ddf8e6b7b04449a78dc6e1f1e844403fce0d1da25eb6d
Instruction Fuzzy Hash: E1325E23A3C68251EB17BB2194D52BBA693AF9C740FC44036DA5DC72D6EF2CE556C320

Function 00007FF77C655C70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF77C655CB5

Part of subcall function 00007FF77C655608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C65561C

Part of subcall function 00007FF77C64A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9CE
Part of subcall function 00007FF77C64A9B8: GetLastError.KERNEL32(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9D8

Part of subcall function 00007FF77C64A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF77C64A94F,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64A979
Part of subcall function 00007FF77C64A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF77C64A94F,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64A99E

_get_daylight.LIBCMT ref: 00007FF77C655CA4

Part of subcall function 00007FF77C655668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C65567C

_get_daylight.LIBCMT ref: 00007FF77C655F1A
_get_daylight.LIBCMT ref: 00007FF77C655F2B
_get_daylight.LIBCMT ref: 00007FF77C655F3C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF77C65617C), ref: 00007FF77C655F63

Strings

Eastern Summer Time, xrefs: 00007FF77C656021
Eastern Standard Time, xrefs: 00007FF77C656009

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction ID: a41159ca12899c9e77a6399d74472c0b955da2c82e3cac3455962cff85b38fbf
Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction Fuzzy Hash: A0D1B223B3864245E722BF21E4C55BAA752EF4C794FE08136EB4DC769ADE3CE4418760

Function 00007FF77C6569D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF77C656708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C656749
Part of subcall function 00007FF77C656708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6567C7
Part of subcall function 00007FF77C656708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C656818

CreateFileW.KERNELBASE ref: 00007FF77C656ADA
CreateFileW.KERNEL32 ref: 00007FF77C656B2A
GetLastError.KERNEL32 ref: 00007FF77C656B5A
GetFileType.KERNELBASE ref: 00007FF77C656B6F
GetLastError.KERNEL32 ref: 00007FF77C656B79
CloseHandle.KERNEL32 ref: 00007FF77C656BAC
CloseHandle.KERNEL32 ref: 00007FF77C656D0F
CreateFileW.KERNEL32 ref: 00007FF77C656D44
GetLastError.KERNEL32 ref: 00007FF77C656D53

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: 6e974f1467f80e3e32f6f854cc6697c8b9e4dcbf63594fe474f39d4998d22fe0
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 8CC1DF37B38A4185EB51EF64D4812AE7762EB88B98B914225DF2E9B394CF38D151C310

Function 00007FF77C6383B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF77C638B09,00007FF77C633FA5), ref: 00007FF77C63841B
RemoveDirectoryW.KERNEL32(?,00007FF77C638B09,00007FF77C633FA5), ref: 00007FF77C63849E
DeleteFileW.KERNELBASE(?,00007FF77C638B09,00007FF77C633FA5), ref: 00007FF77C6384BD
FindNextFileW.KERNELBASE(?,00007FF77C638B09,00007FF77C633FA5), ref: 00007FF77C6384CB
FindClose.KERNEL32(?,00007FF77C638B09,00007FF77C633FA5), ref: 00007FF77C6384DC
RemoveDirectoryW.KERNELBASE(?,00007FF77C638B09,00007FF77C633FA5), ref: 00007FF77C6384E5

Strings

%s\*, xrefs: 00007FF77C6383E2

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: 3c5da9064b05a0eb78b995f2950a23fea1c5633528eee9ef15dba30a203920cc
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: BB415423A3C54295EB71AB14A4C45FBA362FF9CB54FD00232DA9DC2A95DF3CD5498710

Function 00007FF77C655EEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF77C655F1A

Part of subcall function 00007FF77C655668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C65567C

_get_daylight.LIBCMT ref: 00007FF77C655F2B

Part of subcall function 00007FF77C655608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C65561C

_get_daylight.LIBCMT ref: 00007FF77C655F3C

Part of subcall function 00007FF77C655638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C65564C

Part of subcall function 00007FF77C64A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9CE
Part of subcall function 00007FF77C64A9B8: GetLastError.KERNEL32(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9D8

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF77C65617C), ref: 00007FF77C655F63

Strings

Eastern Summer Time, xrefs: 00007FF77C656021
Eastern Standard Time, xrefs: 00007FF77C656009

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction ID: fc3b9eb9033d41aaf311671fe72dcb4598f5c85cbe5fa44e01d0c07e918b8a77
Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction Fuzzy Hash: 80514D33B3864286E721FF21A9C15AAA762AB4C784F904536EB4DC7696DF3CE4408760

Function 00007FF77C6392F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF77C639323
FindClose.KERNELBASE ref: 00007FF77C639332

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: 2ee977b4d359e8598270d5b5f578115adeef70896603c7c67b083c718fa6027b
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: D9F0C863A38741C6F7B19B60B4C8777B351AB8C328F880335DAAD466D4DF3CD0588A10

Function 00007FF77C650938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction ID: 265ac905bbca1fd2ecdd2a1df0392568171ce2c57534d73d83957c605237d8ac
Opcode Fuzzy Hash: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction Fuzzy Hash: 48025223B3D64280FB57BB11A48127BA692AF4DB90FE54635DE5DC63D2EE3DE5018320

Function 00007FF77C631950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF77C637F80: _fread_nolock.LIBCMT ref: 00007FF77C63802A

_fread_nolock.LIBCMT ref: 00007FF77C631A1B

Part of subcall function 00007FF77C632910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF77C631B6A), ref: 00007FF77C63295E

Strings

Could not read full TOC!, xrefs: 00007FF77C631B55
Could not allocate buffer for TOC!, xrefs: 00007FF77C631B1B
calloc, xrefs: 00007FF77C631A68
Failed to seek to cookie position!, xrefs: 00007FF77C6319EE
MEI, xrefs: 00007FF77C631991
Could not allocate memory for archive structure!, xrefs: 00007FF77C631A61
Failed to read cookie!, xrefs: 00007FF77C631A2B
Error on file., xrefs: 00007FF77C631B8D
malloc, xrefs: 00007FF77C631B22
fread, xrefs: 00007FF77C631A32, 00007FF77C631B5C
fseek, xrefs: 00007FF77C6319F5

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: a160029e6a37842be442ab761c617b97701ff7f030f4f7bf0d288629a410a574
Instruction ID: 35c52bdfd9152fee9e3d00afc52d1cfae8b5c8307c3428e46191c0d58e939bc0
Opcode Fuzzy Hash: a160029e6a37842be442ab761c617b97701ff7f030f4f7bf0d288629a410a574
Instruction Fuzzy Hash: 098182B3A3C68685E752BB14E4812BBA3A2EF8C744FD04431DA8DC7795DE3CE6458760

Function 00007FF77C631600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF77C6316A2
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF77C6317DF
fwrite, xrefs: 00007FF77C6317D1
Failed to extract %s: failed to open target file!, xrefs: 00007FF77C63165C
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF77C631742
Failed to create symbolic link %s!, xrefs: 00007FF77C631622
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF77C6317CA
malloc, xrefs: 00007FF77C631749
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF77C6316DA
fread, xrefs: 00007FF77C6317E6
fseek, xrefs: 00007FF77C6316E1
fopen, xrefs: 00007FF77C631663

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: b7cfde611c470d5de2a22cfb734085cfddee959ab285f2d596dd9298a7ff1e46
Instruction ID: 908a1b350d62b9c65f70f82d3611bbacc2d3698607f407ec5d4a5af64406cb9b
Opcode Fuzzy Hash: b7cfde611c470d5de2a22cfb734085cfddee959ab285f2d596dd9298a7ff1e46
Instruction Fuzzy Hash: 0E51A263B3864292EB12BB51A4801BBE362BF8D794FD44531EE1C877D2DE3CE6458360

Function 00007FF77C638850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF77C633CBB), ref: 00007FF77C6388F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF77C633CBB), ref: 00007FF77C6388FA
CreateDirectoryW.KERNELBASE(?,00000000,00007FF77C633CBB), ref: 00007FF77C63893C

Part of subcall function 00007FF77C638A20: GetEnvironmentVariableW.KERNEL32(00007FF77C63388E), ref: 00007FF77C638A57
Part of subcall function 00007FF77C638A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF77C638A79

Part of subcall function 00007FF77C6482A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6482C1

Part of subcall function 00007FF77C632810: MessageBoxW.USER32 ref: 00007FF77C6328EA

Strings

TMP, xrefs: 00007FF77C63888C, 00007FF77C638993
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF77C63896E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF77C6388CC
TMP, xrefs: 00007FF77C6388B2
_MEI%d, xrefs: 00007FF77C638902

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction ID: 3e306fa1590a24d5078505c44ce94abca282e781c9ed829ea387d64cd84a1fc2
Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction Fuzzy Hash: EE417313A3864245EB52BB25A9D51FB9292AF8CB80FD04132EE0DD66D6DD3CE6048320

Function 00007FF77C631210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF77C631276
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF77C6312EF
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF77C6312BA
malloc, xrefs: 00007FF77C6312C1, 00007FF77C6312F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF77C63141E
1.3.1, xrefs: 00007FF77C631249

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
Instruction ID: 449d78a6db43a6b6a4126bdaed83cf8eacd26779eeb93c9f080bc59d0a17e770
Opcode Fuzzy Hash: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
Instruction Fuzzy Hash: EE51B563A3864245E762BB11A4903BBE292BF89794FD44135EE4E877C6DE3CE6418720

Function 00007FF77C64ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF77C64F11A,?,?,-00000018,00007FF77C64ADC3,?,?,?,00007FF77C64ACBA,?,?,?,00007FF77C645FAE), ref: 00007FF77C64EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF77C64F11A,?,?,-00000018,00007FF77C64ADC3,?,?,?,00007FF77C64ACBA,?,?,?,00007FF77C645FAE), ref: 00007FF77C64EF08

Strings

api-ms-, xrefs: 00007FF77C64EE46
ext-ms-, xrefs: 00007FF77C64EE59

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: 668d798f9973a83621ca0681d29cfe874e03cdac1b470e88bd5391cf6b6c1c10
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: A741C427B39A1282EB17EB169884577F292BF4DB90FC84535DD1DDB384EE3CE6058220

Function 00007FF77C6336B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF77C633804), ref: 00007FF77C6336E1
GetLastError.KERNEL32(?,00007FF77C633804), ref: 00007FF77C6336EB

Part of subcall function 00007FF77C632C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C633706,?,00007FF77C633804), ref: 00007FF77C632C9E
Part of subcall function 00007FF77C632C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C633706,?,00007FF77C633804), ref: 00007FF77C632D63
Part of subcall function 00007FF77C632C50: MessageBoxW.USER32 ref: 00007FF77C632D99

Strings

\\?\, xrefs: 00007FF77C63375A
Failed to convert executable path to UTF-8., xrefs: 00007FF77C633790
GetModuleFileNameW, xrefs: 00007FF77C6336FA
Failed to obtain executable path., xrefs: 00007FF77C6336F3
Failed to resolve full path to executable %ls., xrefs: 00007FF77C633739

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: 06af7d9a094265e26c22c70e98f3d0bffe1b72df2d7041147b00421daf22a886
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 90217463B3C54291FB22B721E8943B7A262BF9C394FD04132EA5DC66D5EE2CE505C724

Function 00007FF77C64BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64BEF9

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
Instruction ID: 72343e9ac82cd5047bbc8b378b984324359da8c0ad43e2cdb456e8fcb7a1e565
Opcode Fuzzy Hash: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
Instruction Fuzzy Hash: C6C1D52393CA8691E7526B55D0806BFB792EBC9B80FD54131EE4D8B791CE7CE7458320

Function 00007FF77C638760 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF77C638780
OpenProcessToken.ADVAPI32 ref: 00007FF77C638793
GetTokenInformation.KERNELBASE ref: 00007FF77C6387B8
GetLastError.KERNEL32 ref: 00007FF77C6387C2
GetTokenInformation.KERNELBASE ref: 00007FF77C638802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF77C63881E
CloseHandle.KERNEL32 ref: 00007FF77C638836

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction ID: 868ca856f451a2f1b2052b18092ee8553e4219f53cd6ed36ec3068dd8b33fd62
Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction Fuzzy Hash: 38214422B2864241EB51AB55B49427BE7A2EBCDBA0F900235EA6D836E4DE7CD4448710

Function 00007FF77C6390E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF77C638760: GetCurrentProcess.KERNEL32 ref: 00007FF77C638780
Part of subcall function 00007FF77C638760: OpenProcessToken.ADVAPI32 ref: 00007FF77C638793
Part of subcall function 00007FF77C638760: GetTokenInformation.KERNELBASE ref: 00007FF77C6387B8
Part of subcall function 00007FF77C638760: GetLastError.KERNEL32 ref: 00007FF77C6387C2
Part of subcall function 00007FF77C638760: GetTokenInformation.KERNELBASE ref: 00007FF77C638802
Part of subcall function 00007FF77C638760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF77C63881E
Part of subcall function 00007FF77C638760: CloseHandle.KERNEL32 ref: 00007FF77C638836

LocalFree.KERNEL32(?,00007FF77C633C55), ref: 00007FF77C63916C
LocalFree.KERNEL32(?,00007FF77C633C55), ref: 00007FF77C639175

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF77C639183
D:(A;;FA;;;%s), xrefs: 00007FF77C639157
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF77C639142
S-1-3-4, xrefs: 00007FF77C639121

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction ID: c4cbfdd55ff3bf00d0f1a6a12ec3965102984bd89673b3ed4d265df4b183e318
Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction Fuzzy Hash: 3F211C23A38A4292E752BB10E5952EBA362FF8C780FD44035EA4D93796DF3CD9458760

Function 00007FF77C637E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF77C63352C,?,00000000,00007FF77C633F23), ref: 00007FF77C637F22

Strings

%s%c, xrefs: 00007FF77C637E94
%.*s, xrefs: 00007FF77C637EDB
\, xrefs: 00007FF77C637E87

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
Instruction ID: ce051cdecd649ffd4b8b906fc6b4726a4461688e1ba2e9fab7c7db271e23a92d
Opcode Fuzzy Hash: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
Instruction Fuzzy Hash: 7431BA22739AC145EB22A711A9907A7A355FF8CBE4F840231EE6D877C9DF2CD601C710

Function 00007FF77C64CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77C64CFBB), ref: 00007FF77C64D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77C64CFBB), ref: 00007FF77C64D177

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: 9bcbff13d573288282b5b02289e3beb4b2873bfd979ac45536a91a6ebeef06f2
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: C791A723F3865195F792AF65D4C027FBBA2BB48B88F944135DF0E9B685CE38D6418720

Function 00007FF77C64F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF77C64FAEC
_get_daylight.LIBCMT ref: 00007FF77C64FAFD
_get_daylight.LIBCMT ref: 00007FF77C64FB0E
_isindst.LIBCMT ref: 00007FF77C64FBD9

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 23ca9c12ba1978b4d5c20015507695e955a0a2c7a3bda9264c7e232cf9c106ba
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 04513873F381118AFB15EF2499D16BEB7A2AB08358F900235DE1DD6AE4DB38E601C711

Function 00007FF77C6457EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF77C64581F
GetFileInformationByHandle.KERNELBASE ref: 00007FF77C645881
GetLastError.KERNEL32 ref: 00007FF77C645912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77C645724), ref: 00007FF77C64595E

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 6433626fc0a770ba4f6d83c09f3326f67990d509dea1b3a303c7df294cc1bd66
Instruction ID: 5abc24d194951af423cac8284e64c59d93a2f0c5a19dfef73498942b8bd932ab
Opcode Fuzzy Hash: 6433626fc0a770ba4f6d83c09f3326f67990d509dea1b3a303c7df294cc1bd66
Instruction Fuzzy Hash: 7F519233E38A418AFB11EF71D4903BE73A2AB48B58F944435DE4D9B689DF38D6418720

Function 00007FF77C645698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6456C5
CreateFileW.KERNELBASE ref: 00007FF77C645704
CloseHandle.KERNEL32 ref: 00007FF77C645739

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
Instruction ID: 6b2031f2022a60333ae8fa073d7710fa471f9d5118068ebb59b7a18e2bb2e1c5
Opcode Fuzzy Hash: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
Instruction Fuzzy Hash: C641B433D38B8183E351EB20959037AB261FB98764F509334EA5C47AD6DF6CA7E08720

Function 00007FF77C63CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77C63CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF77C63CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF77C63CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF77C63CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF77C63CD91

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 3c75460419d0a6bd819aa20e2bffc3bbfbe21fee87ce08a626a3ed1afae0dc49
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: C1313823E7851255FB27BB2498913BBA683AF49384FD44534FA0DCB2D7DE2CA505C270

Function 00007FF77C649AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF77C649A9C), ref: 00007FF77C649AB1
TerminateProcess.KERNEL32(?,?,?,00007FF77C649A9C), ref: 00007FF77C649ABC
ExitProcess.KERNEL32 ref: 00007FF77C649ACB

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction ID: be6f99faa977aad35e1c39867b3f0cbee6e5ce4f57dd56764d437963ccc1f0e8
Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction Fuzzy Hash: F9D09E12B7874642EB563B706CD947AA2576F8C745FA41438DD0B9A393ED2CA6894320

Function 00007FF77C6401AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6401F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6402E7

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: 35161f00ceea5db8d4f734909a7fbe4a85e0f33642812b5ab0d2d79bb5a6cf21
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: 7F512B2373D26286E727BA65948067BB583AF4CBA4F944230DE6D8B7C5CF3CD7018620

Function 00007FF77C64C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF77C64C33D), ref: 00007FF77C64C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF77C64C33D), ref: 00007FF77C64C1FA

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 12cc33ef135ed66a18025d4f413e7e3b6aba7442d071318187ee3e8eb1d6db66
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 1611C862738A8181DB119B25B49416AB352FB89BF4F944331EE7D8B7D5CE7CD2118700

Function 00007FF77C645994 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77C6458A9), ref: 00007FF77C6459C7
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77C6458A9), ref: 00007FF77C6459DD

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
Instruction ID: d8887b3e285c5373af64de2fea67744269b9724e38d36915a6aee9ec10071179
Opcode Fuzzy Hash: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
Instruction Fuzzy Hash: 9D11A73363CA4281EB556B51A48117BF761FB88771F900235FA9DC5AD8EF2CD254CB10

Function 00007FF77C64A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9CE
GetLastError.KERNEL32(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9D8

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: fed10fb103d6477cc030b2ddc0bbe0c8510855317c9b2dfa37a530ce330f7167
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 66E0BF52F3960252FF167BB264D617BA2536FCC740BC54434DA1DDA2A2DE2CAA858220

Function 00007FF77C64ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF77C64AA45,?,?,00000000,00007FF77C64AAFA), ref: 00007FF77C64AC36
GetLastError.KERNEL32(?,?,?,00007FF77C64AA45,?,?,00000000,00007FF77C64AAFA), ref: 00007FF77C64AC40

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: b1524c1358b2d25084c8c5301f31bbd33835f4cff8a29cb184a56de0c9176cb3
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 14215313B3C64251EB967761A4D127FA6839F8CB90F984235DA1ECB7C2CE6CE7454310

Function 00007FF77C64BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64BF44

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 77f2f9c0c3853e5df4dc99a11e1b25eaa2aec769d06f52d5773e5caefc843251
Instruction ID: 313c2e9e3f84f81d07dcb7a95320bdcaaa8fd6e8f9c99358a15c186b3d1f4e4b
Opcode Fuzzy Hash: 77f2f9c0c3853e5df4dc99a11e1b25eaa2aec769d06f52d5773e5caefc843251
Instruction Fuzzy Hash: D841E83393860187EB75EB55E58017BB3A2EB59B45F900131DA8DCB691CF2DE702CB61

Function 00007FF77C637F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF77C63802A

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 8334f334696440ef64ed4453da584d980c1c0ded1461c6629ef7e16216bca0a0
Instruction ID: e3ed3fa545c1b11e1a67dfdd069fd642da0a6efdd0b6c3f98ac237d2d5f8f01f
Opcode Fuzzy Hash: 8334f334696440ef64ed4453da584d980c1c0ded1461c6629ef7e16216bca0a0
Instruction Fuzzy Hash: B7215022B3865145EB52BA1265843FBE652BF4DBC4FC84431EE4D8B786CF3DE2418710

Function 00007FF77C64B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64BA32

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction ID: 3d36fddc3f7c395abd5bcc2371566757168ab19091f844517a99fa8964755f9f
Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction Fuzzy Hash: 2E318123A38A4285E7537B95C48227EB652EB88B94FC54135E91D8B3D2CE7CE7818730

Function 00007FF77C6499D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF77C6499FF

Part of subcall function 00007FF77C649AF8: GetModuleHandleExW.KERNEL32 ref: 00007FF77C649B1D
Part of subcall function 00007FF77C649AF8: GetProcAddress.KERNEL32 ref: 00007FF77C649B33
Part of subcall function 00007FF77C649AF8: FreeLibrary.KERNEL32 ref: 00007FF77C649B5A

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction ID: 9b064eea46aee8b79be44a54ffad0cab2c1df290000ddde6534478ea85bd0ee4
Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction Fuzzy Hash: 3821A632A2474189EB15AF64C4806FD73A5FB48318F840635D71D4AAC5EF38D784CB50

Function 00007FF77C646004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C645F69

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 9f4381dc3d53c78282251c2d9cc7030f33228ae357ad646e0d8d3cb9feac2e3d
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: E3111233938A4141EBA27E51944117FF265AF49B84FC44031EE4C9BA9ADF3DD7418B22

Function 00007FF77C6563C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6563E7

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 0fdeabe8b31d1c91d4da5585757769e766ca67f3e93f2c05b57d9ea6e98d6b20
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 4621447363864286D762AF18E48037AB662EB88B94FA45234D75DC77D5DF3CD501CB10

Function 00007FF77C64042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C640480

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 91d204855f39683eabb33912eac4b5b170ee622047d929826912eb00450ae69e
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 6F018223A3875180EB06FF52594106AF692AF89FE0B984631DE5C9BBDACE3CD3014710

Function 00007FF77C647F6C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C647FAA

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction ID: 863fb2fee8f79ee3ff9067b55dccfaca50392c573422bc69a91078e5325e347c
Opcode Fuzzy Hash: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction Fuzzy Hash: A3015B22A3D64280FBA27A2265C117BF292AF5C794FD44535EA1CCA6C6DF2CA741C231

Function 00007FF77C6482A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6482C1

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: 2ceb2605b5ba01015001457685376c04deda522089056d3aef5238f6e49a4213
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: 46E0B6A2A3CA0787F7573AA445C21BBB1525F9D740FC14430E908DE2C3DE2CAB49A731

Function 00007FF77C64EC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF77C64B39A,?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA), ref: 00007FF77C64EC5D

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction ID: bd2e7b21759556caa03de58cd3f70ddbbed8d86597f48a0ed6911e2e873c806f
Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction Fuzzy Hash: 98F04F5AB3920640FF567A6254D12B7E2825F8CB80FCC5430C91DCE2D1ED1CA7914230

Function 00007FF77C64D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF77C640D00,?,?,?,00007FF77C64236A,?,?,?,?,?,00007FF77C643B59), ref: 00007FF77C64D6AA

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 71995121434ff04a94afeb5904bb1de097200a28953701fc6daf20953cc25ded
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 78F0DA12F3924645FF967B619891677A2925F9DBA0F880630AE2EC92D5DE2CA7408530

Non-executed Functions

Function 00007FF77C6376B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF77C6376C7
GetLastError.KERNEL32 ref: 00007FF77C6376D9
GetProcAddress.KERNEL32 ref: 00007FF77C637715
GetLastError.KERNEL32 ref: 00007FF77C637727
GetProcAddress.KERNEL32 ref: 00007FF77C637740
GetLastError.KERNEL32 ref: 00007FF77C637752
GetProcAddress.KERNEL32 ref: 00007FF77C63776B
GetLastError.KERNEL32 ref: 00007FF77C63777D
GetProcAddress.KERNEL32 ref: 00007FF77C637799
GetLastError.KERNEL32 ref: 00007FF77C6377AB
GetProcAddress.KERNEL32 ref: 00007FF77C6377C7
GetLastError.KERNEL32 ref: 00007FF77C6377D9
GetProcAddress.KERNEL32 ref: 00007FF77C6377F5
GetLastError.KERNEL32 ref: 00007FF77C637807
GetProcAddress.KERNEL32 ref: 00007FF77C637823
GetLastError.KERNEL32 ref: 00007FF77C637835
GetProcAddress.KERNEL32 ref: 00007FF77C637851
GetLastError.KERNEL32 ref: 00007FF77C637863

Strings

Tcl_JoinThread, xrefs: 00007FF77C637875, 00007FF77C637897
Tcl_Init, xrefs: 00007FF77C6376C0, 00007FF77C6376DF
Tcl_ThreadQueueEvent, xrefs: 00007FF77C6379B7, 00007FF77C6379D9
Tcl_DeleteInterp, xrefs: 00007FF77C6377EB, 00007FF77C63780D
Tcl_CreateObjCommand, xrefs: 00007FF77C637A6F, 00007FF77C637A91
Tk_GetNumMainWindows, xrefs: 00007FF77C637C97, 00007FF77C637CB9
Tcl_CreateInterp, xrefs: 00007FF77C63770B, 00007FF77C63772D
Failed to get address for %hs, xrefs: 00007FF77C6376E8
Tcl_FinalizeThread, xrefs: 00007FF77C6377BD, 00007FF77C6377DF
Tcl_EvalFile, xrefs: 00007FF77C637B83, 00007FF77C637BA5
Tcl_GetObjResult, xrefs: 00007FF77C637B55, 00007FF77C637B77
Tcl_DoOneEvent, xrefs: 00007FF77C637761, 00007FF77C637783
Tcl_ThreadAlert, xrefs: 00007FF77C6379E5, 00007FF77C637A07
Tcl_EvalEx, xrefs: 00007FF77C637BB1, 00007FF77C637BD3
Tk_Init, xrefs: 00007FF77C637C69, 00007FF77C637C8B
Tcl_GetString, xrefs: 00007FF77C637A9D, 00007FF77C637ABF
Tcl_Finalize, xrefs: 00007FF77C63778F, 00007FF77C6377B1
Tcl_ConditionFinalize, xrefs: 00007FF77C63792D, 00007FF77C63794F
Tcl_NewByteArrayObj, xrefs: 00007FF77C637AF9, 00007FF77C637B1B
Tcl_NewStringObj, xrefs: 00007FF77C637ACB, 00007FF77C637AED
Tcl_MutexUnlock, xrefs: 00007FF77C6378D1, 00007FF77C6378F3
Tcl_SetVar2Ex, xrefs: 00007FF77C637B27, 00007FF77C637B49
Tcl_CreateThread, xrefs: 00007FF77C637819, 00007FF77C63783B
Tcl_Alloc, xrefs: 00007FF77C637C0D, 00007FF77C637C2F
Tcl_MutexLock, xrefs: 00007FF77C6378A3, 00007FF77C6378C5
Tcl_SetVar2, xrefs: 00007FF77C637A41, 00007FF77C637A63
GetProcAddress, xrefs: 00007FF77C6376EF
Tcl_GetCurrentThread, xrefs: 00007FF77C637847, 00007FF77C637869
Tcl_MutexFinalize, xrefs: 00007FF77C6378FF, 00007FF77C637921
Tcl_ConditionWait, xrefs: 00007FF77C637989, 00007FF77C6379AB
Tcl_ConditionNotify, xrefs: 00007FF77C63795B, 00007FF77C63797D
Tcl_FindExecutable, xrefs: 00007FF77C637736, 00007FF77C637758
Tcl_GetVar2, xrefs: 00007FF77C637A13, 00007FF77C637A35
Tcl_Free, xrefs: 00007FF77C637C3B, 00007FF77C637C5D
Tcl_EvalObjv, xrefs: 00007FF77C637BDF, 00007FF77C637C01

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: c7cd5e8f845eefd49097c50b4c305f367ae8b8077bee09d16880e4613f3d8226
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 5C02BE62B3DB0790EB17BB55BAD4577A3A3AF4D754BE41031CA2D822A0EF3CB5448235

Function 00007FF77C65411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF77C65416A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6547D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C65494C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C654C0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C654E2A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C655067
memcpy_s.LIBCPMT ref: 00007FF77C655142
memcpy_s.LIBCPMT ref: 00007FF77C6551ED
memcpy_s.LIBCPMT ref: 00007FF77C6552BC

Strings

1#INF, xrefs: 00007FF77C654293
1#SNAN, xrefs: 00007FF77C65427A
1#QNAN, xrefs: 00007FF77C654283
1#IND, xrefs: 00007FF77C654257

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction ID: 5bffa899b5d331bcb377d662f0390a6b1d669f404d4e1a039e2e8739d7d860bd
Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction Fuzzy Hash: CDB2DB73B382924BE7669E64E4847FEB7A2FB58344FA05135D70D97A88DB38E500CB50

Function 00007FF77C63AD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distance code, xrefs: 00007FF77C63B624
invalid distance too far back, xrefs: 00007FF77C63B6E0
invalid bit length repeat, xrefs: 00007FF77C63B109
invalid distances set, xrefs: 00007FF77C63B210
too many length or distance symbols, xrefs: 00007FF77C63AEB6
invalid literal/lengths set, xrefs: 00007FF77C63B1A3
invalid code lengths set, xrefs: 00007FF77C63AE9D
invalid code -- missing end-of-block, xrefs: 00007FF77C63B136
invalid literal/length code, xrefs: 00007FF77C63B452

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction ID: b25cb76129514e7854098d9f175a915b6ba4727d7fc7215085408d8db41f9884
Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction Fuzzy Hash: 8352C473A346A68BD7959F14D498B7E7BAAFB88340F414139EA4A877C0DB3CD844CB50

Function 00007FF77C63D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF77C63D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF77C63D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF77C63D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF77C63D240
IsDebuggerPresent.KERNEL32 ref: 00007FF77C63D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF77C63D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF77C63D2BC

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: 9d56d606f5c3b37c063e9bc6f7c515f73ed0b3cb21dc667cbd5a27686f391b1e
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 4A313F73728A8186EB619F60E8807FE6361FB88704F544039DB4D87B99DF38D548C724

Function 00007FF77C64A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF77C64A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF77C64A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF77C64A750
IsDebuggerPresent.KERNEL32 ref: 00007FF77C64A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF77C64A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF77C64A79E

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: 10961d40ca19563583e6b43eebefc639103177f96609aa5d8f11ceec8a24b810
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: 8E317137628B8186DB219F24E8802AFB3A1FB88754F940135EB8D87B59DF3CC1558B10

Function 00007FF77C6518E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C651930
FindFirstFileExW.KERNEL32 ref: 00007FF77C651A3A

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction ID: 1af0f1ce52f67dc771e30ee579fc503d775ed074317064283adea7303a5f4715
Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction Fuzzy Hash: 31B1B7A7B3869241EB62AB21A4801BBE352EB4CBD4FA44131DF5D97B95EE3CE541C310

Function 00007FF77C63D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF77C63D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF77C63D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF77C63D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF77C63D0D6

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: 85532175cff1d26de166d2022245fc2d59380cc482b0a8a62b0afb519ab4363c
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 91111F26B28B05CAEB00DF60E8952BA73A4F75D758F440E31DE5D86764DF78D1548350

Function 00007FF77C653C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF77C653CE6
memcpy_s.LIBCPMT ref: 00007FF77C653D11

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 2a443d787266208f3fe6e1f6dc1e14a8fea799f5dd5a13a2d14c910aec8d8daa
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: D4C1D473B3868687D7259F15B08467AF7A2F798B84FA48135DB4E83744DA3DE801CB40

Function 00007FF77C63A4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF77C63A535
, xrefs: 00007FF77C63A5CB
header crc mismatch, xrefs: 00007FF77C63A991

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction ID: 7a0ced1172a0c7d9fd826275a7e0bff0420da93edc2292e1521b2874afdc5993
Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction Fuzzy Hash: 60F1A263A383C58BE796AF1480C8B3BBAEEEF49740F464538DA4997391CB38D441D750

Function 00007FF77C659798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF77C6599E7
RaiseException.KERNEL32 ref: 00007FF77C6599F8

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction ID: e484e08f275c10dde63278c9a4ffa9ab5912b3cf3ac605989e8b8c59f5f10efc
Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction Fuzzy Hash: 46B1B077A24B858BEB16DF29D88236D77E1F748B48F288821DB5D837A4CB39D452C710

Function 00007FF77C643A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF77C643B82
, xrefs: 00007FF77C643DC4

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction ID: c0e99e00fcc50e21bb1fae4ce2a4bd303eddbc80468111d06663ba0c39ebc282
Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction Fuzzy Hash: B8E1D73793864281EB6AAF1581D013EB3A2FF5DBC8F945135DA0E8B694DF29DB41C710

Function 00007FF77C63A34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF77C63A4CB
invalid window size, xrefs: 00007FF77C63A4B2

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction ID: 1f88667ea05bfe8b6a7b5358c6da9c9023c26f078b351ed93b057af13d9977f0
Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction Fuzzy Hash: DD919673A3828687E7A69A15D4C8B3F7AAAFF48350F514139DA4AC67C1DB38E540CB50

Function 00007FF77C64DF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF77C64E0EA
e+000, xrefs: 00007FF77C64E06D

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction ID: 4fa45a3c4a72ca2fb37fd64d51a4c004221dbfdcee5511a4f48f14269134a13f
Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction Fuzzy Hash: 1A518E27F382C185E7269E35988076AF792E749B94F888231CB6C8BAC5CF3DD641C710

Function 00007FF77C64DACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF77C64DE0E

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 6c5ba479eddbaed7b0cfc7de332f6826d514b8811d1cf928fa27c988e8ebc48b
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: ABA14763E3878546EB62DF25E0807AABB96AB59784F448031DF8D8B785DE3DD701C710

Function 00007FF77C648804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF77C648823

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction ID: 68a6bf2af83180e0fac1e8f3ea286d60a8396082a1d4f2fdcfc19d95a2ed1261
Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction Fuzzy Hash: FD517C53F3864251EB66BA26598117BE2926F8CF88BD84134DE0DCB796EE3CE7414320

Function 00007FF77C6534F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF77C6534F4

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction ID: 80abf53b5a22174fba50cce20d1748f9b30fbfeb6f2cab2e758693079d15d357
Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction Fuzzy Hash: 85B09221F3BA06C2EB0A3B216CC322A62A67F8C700FE80138C61C80330DE2C20E55720

Function 00007FF77C643610 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction ID: bb38cca10c21ca041fd1bf83137e717e8a707a8f0b1efc07b6495a9580ca80be
Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction Fuzzy Hash: D6D1DA63A3864245EB6AAE25809023FB792FF09B98F944135CE4D8B7D5DF39DB41C360

Function 00007FF77C639870 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction ID: a1dcb09102cd3b890f30b215da17ec4751cdf7a60371fd96f56d62f5e8a7b17c
Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction Fuzzy Hash: D3C18E762281E08BD28AEB29E4A947A73D1F78930DBD5406BEF87477C5C73CA514DB20

Function 00007FF77C642C80 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction ID: 980aad57feca3a352af366e2c4b99b9700175fb95356871d2e8452e40af18301
Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction Fuzzy Hash: C3B19F73938B4585E7669F29C09023EBBA2E749B48FB44135CA4D8B395CF39D782C724

Function 00007FF77C64E5E0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction ID: 2e604e1c3e0ecfccd10f8660a03c4b2e2de191d2aa814b2fe6ec43569599903e
Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction Fuzzy Hash: 2181E577A3828186DB75AB19948037BFA92FB49794F904235DA8D8BB95CE3CD7008B10

Function 00007FF77C656488 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0ac6b4c320f8a85a272a2d207e476957e076465a5e78eda0eae0a584ad6410a5
Instruction ID: b9921609f8838285878739808f27d24ef17a516087b3bb204b0797b4e1f3bfa4
Opcode Fuzzy Hash: 0ac6b4c320f8a85a272a2d207e476957e076465a5e78eda0eae0a584ad6410a5
Instruction Fuzzy Hash: A361E723F3C19286E766A928A0D423FE592AF48360FB40239D71DC67D9DE6DE900C721

Function 00007FF77C641DC4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 79fbd50ccd51925f184e2758af315cfbfeb4af61d711e441889b479713ee3d13
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 7151AB77A3465281E7659B19C080639B7A2EB4CB58F744131CE4C8B795CB3AEF43C750

Function 00007FF77C6421D4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: c98ba9805a2bb65b5f68b7287f47c91d60fc533efee3d2fdf3f449093514480a
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 00516573A3865185E7269B29C08022A73A3EB58B58F745131CE4D8B798CF3AEB43C750

Function 00007FF77C6419B4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 109c7a02c1cc093d591ff92b119477efd8dcadedca8bf9e10929948890da3b4f
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 5351A9B7A3465182E7259B29C08023A7762EB4CB58F744131CE4D9B7A4DF3AEB83C750

Function 00007FF77C641FD0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 539079320b9b90d792da4d036f837c5c94d2178b0035c23a0a1f7ccc154282e2
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 02518537A3865185E7269B29C48022AB7A3EB58F58F744131CB4C9B794CF3AEF42C750

Function 00007FF77C6417B0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 6aef64aa11d20ecd22a83e1d0a47f059378dca25583c6701ae0dc2fb2b111ca6
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 5F51A777B3865185E7269B28C08027EB7A2EB48B58F745131CE4D9B794CF3AEB42C750

Function 00007FF77C641BC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: da1a1fcb98959fddbfdfc192412c22cacc64cb40b5527f5fd930cd5de84b4749
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 0A51A7B3B3465585E7269B29C48023977A2EB49B58FB44131CE4C9B794CB3AEB43C750

Function 00007FF77C645DA0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 7ab24bc8b9d2d3b3332900b6058d457a3311ad095b8e6a3bd11c34c607d7fe0a
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: E441EC7383DF4A84EB9359280440ABAF6829F267A0DD81270DD99DB7DADD0D2B47C122

Function 00007FF77C649F10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction ID: ef76f616fd03d6c3cd8159de3ac73a801655b1ddb008bf689e3c9fd757e883e6
Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction Fuzzy Hash: 4841F423738A5582EF04DF2AD99416AB3A2BB5CFD4B899032DE4DD7B54EE3DC5418300

Function 00007FF77C648154 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: 4d76a3a325d0e906066b872cc21b8f37af6d84f28124296cf77c745b5cb6b879
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: A231B433B38B4281E765BB25648013FB696AB8DB90F944239EA5DD7BD6DF3CD2014314

Function 00007FF77C6595E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction ID: 2120d58e133a162225d0a0add127b26b1c6bb30833ab59f0f60ba5e8bb02f116
Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction Fuzzy Hash: 5BF044727382A58ADBA99F69A44362A77D1F708390F909539D68DC3E44DA3C90618F14

Function 00007FF77C63D37C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction ID: 821cc8c32432f63bf1e62d43d4c28c80bd0aba48774594c90168a87e0b456b94
Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction Fuzzy Hash: 64A00122A3C80AD0E746AB00A8D0176A322BB99300B900031E60DC50A09E3CA8109221

Function 00007FF77C635820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C635830
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C635842
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C635879
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C63588B
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6358A4
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6358B6
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6358CF
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6358E1
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6358FD
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C63590F
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C63592B
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C63593D
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C635959
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C63596B
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C635987
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C635999
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6359B5
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6359C7

Strings

PyUnicode_Replace, xrefs: 00007FF77C635FC7, 00007FF77C635FE9
PyEval_EvalCode, xrefs: 00007FF77C635BA5, 00007FF77C635BC7
PyImport_ExecCodeModule, xrefs: 00007FF77C635C01, 00007FF77C635C23
PyObject_CallFunction, xrefs: 00007FF77C635CE7, 00007FF77C635D09
Py_InitializeFromConfig, xrefs: 00007FF77C6358F3, 00007FF77C635915
PyMem_RawFree, xrefs: 00007FF77C635C8B, 00007FF77C635CAD
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF77C635DCD, 00007FF77C635DEF
Py_DecRef, xrefs: 00007FF77C635826, 00007FF77C635848
PyObject_Str, xrefs: 00007FF77C635D9F, 00007FF77C635DC1
PyConfig_InitIsolatedConfig, xrefs: 00007FF77C6359AB, 00007FF77C6359CD
Failed to get address for %hs, xrefs: 00007FF77C635851
PyStatus_Exception, xrefs: 00007FF77C635E29, 00007FF77C635E4B
PyUnicode_FromString, xrefs: 00007FF77C635F6B, 00007FF77C635F8D
PyUnicode_FromFormat, xrefs: 00007FF77C635F3D, 00007FF77C635F5F
Py_ExitStatusException, xrefs: 00007FF77C63589A, 00007FF77C6358BC
PyMarshal_ReadObjectFromString, xrefs: 00007FF77C635C5D, 00007FF77C635C7F
PyObject_CallFunctionObjArgs, xrefs: 00007FF77C635D15, 00007FF77C635D37
PyErr_Fetch, xrefs: 00007FF77C635ABF, 00007FF77C635AE1
PySys_GetObject, xrefs: 00007FF77C635E57, 00007FF77C635E79
PySys_SetObject, xrefs: 00007FF77C635E85, 00007FF77C635EA7
PyConfig_SetBytesString, xrefs: 00007FF77C635A07, 00007FF77C635A29
PyErr_Clear, xrefs: 00007FF77C635A91, 00007FF77C635AB3
PyUnicode_DecodeFSDefault, xrefs: 00007FF77C635F0F, 00007FF77C635F31
PyImport_ImportModule, xrefs: 00007FF77C635C2F, 00007FF77C635C51
PyConfig_Clear, xrefs: 00007FF77C63597D, 00007FF77C63599F
Py_IsInitialized, xrefs: 00007FF77C635921, 00007FF77C635943
PyObject_SetAttrString, xrefs: 00007FF77C635D71, 00007FF77C635D93
PyObject_GetAttrString, xrefs: 00007FF77C635D43, 00007FF77C635D65
GetProcAddress, xrefs: 00007FF77C635858
PyUnicode_Join, xrefs: 00007FF77C635F99, 00007FF77C635FBB
PyErr_Print, xrefs: 00007FF77C635B49, 00007FF77C635B6B
PyRun_SimpleStringFlags, xrefs: 00007FF77C635DFB, 00007FF77C635E1D
PyErr_Restore, xrefs: 00007FF77C635B77, 00007FF77C635B99
PyErr_NormalizeException, xrefs: 00007FF77C635AED, 00007FF77C635B0F
PyErr_Occurred, xrefs: 00007FF77C635B1B, 00007FF77C635B3D
PyImport_AddModule, xrefs: 00007FF77C635BD3, 00007FF77C635BF5
PyUnicode_AsUTF8, xrefs: 00007FF77C635EB3, 00007FF77C635ED5
PyConfig_SetWideStringList, xrefs: 00007FF77C635A63, 00007FF77C635A85
PyConfig_Read, xrefs: 00007FF77C6359D9, 00007FF77C6359FB
Py_DecodeLocale, xrefs: 00007FF77C63586F, 00007FF77C635891
Py_PreInitialize, xrefs: 00007FF77C63594F, 00007FF77C635971
PyConfig_SetString, xrefs: 00007FF77C635A35, 00007FF77C635A57
Py_Finalize, xrefs: 00007FF77C6358C5, 00007FF77C6358E7
PyModule_GetDict, xrefs: 00007FF77C635CB9, 00007FF77C635CDB
PyUnicode_Decode, xrefs: 00007FF77C635EE1, 00007FF77C635F03

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: 0f67f3f9f5ef3faca929c6e198b9d2a730e8d2c9f8a7c052984995e3f0724bfe
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: 5022B566B39F0791FB07BB55B8D01B6A7A7AF4C745FE41436C91E82264EF3CA1488234

Function 00007FF77C6381C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77C639400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF77C6345E4,00000000,00007FF77C631985), ref: 00007FF77C639439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF77C6388A7,?,?,00000000,00007FF77C633CBB), ref: 00007FF77C63821C

Part of subcall function 00007FF77C632810: MessageBoxW.USER32 ref: 00007FF77C6328EA

Strings

\, xrefs: 00007FF77C638251
%.*s, xrefs: 00007FF77C6382FC
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF77C63828D
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF77C6381F3
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF77C6382C9
CreateDirectory, xrefs: 00007FF77C63836C
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF77C638363
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF77C638230

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction ID: b4795c968364faee0818537591df4f752c2475f69d1f9ffb18c0df18257a8dfb
Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction Fuzzy Hash: 92517513B3C64241FB52BB61A9D16BBE253AF9C780FD44032DB0EC66D6EE2CE5058760

Function 00007FF77C632180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF77C6321AB
SelectObject.GDI32 ref: 00007FF77C6321F2
DrawTextW.USER32 ref: 00007FF77C632215
SelectObject.GDI32 ref: 00007FF77C63222B
ReleaseDC.USER32 ref: 00007FF77C63223B
MoveWindow.USER32 ref: 00007FF77C63228B
MoveWindow.USER32 ref: 00007FF77C6322CB
MoveWindow.USER32 ref: 00007FF77C63231E
MoveWindow.USER32 ref: 00007FF77C632366

Strings

P%, xrefs: 00007FF77C6321FF

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: be180701450347c49b5ca29539e970a7d9caaae2e24e4650ffb24c923fce21bf
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: AB51D5366287A186D7349F26B4581BBB7A2FB98B61F004121EFDE83695DF3CD045DB20

Function 00007FF77C6380B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF77C6380EF
GetWindowLongPtrW.USER32 ref: 00007FF77C63816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF77C638182
GetLastError.KERNEL32 ref: 00007FF77C63818C
SetWindowLongPtrW.USER32 ref: 00007FF77C6381A3

Strings

Needs to remove its temporary files., xrefs: 00007FF77C638175

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: c70121ada4e028e0be351826aa30a68c010c1f9b981b2844ad93ef5d9bcf0dff
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: 1F213523B38A4281E7566B79B89417BA252EFCCF90F984131DF2DC3394DE2CD5918321

Function 00007FF77C646300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C646343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C646730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6469CC

Strings

f, xrefs: 00007FF77C646465
p, xrefs: 00007FF77C64646D
:, xrefs: 00007FF77C6464FC
p, xrefs: 00007FF77C6463F5
-, xrefs: 00007FF77C6463D9

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 91926c82e6b76e1147182d4e737ab68119a92b102291a1875d959d8cbb4e90c1
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 701283A3A3C15386FB267B14D1942BBB693FB48754FC44435E6898E6C4DB7CE7808B20

Function 00007FF77C641038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C641078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C641440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6416DF

Strings

f, xrefs: 00007FF77C641110
f, xrefs: 00007FF77C64117A
p, xrefs: 00007FF77C641182
p, xrefs: 00007FF77C64111D
f, xrefs: 00007FF77C6412C5

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: fac51973bd1196917c338ec96bc6720873c6b21acca37337ae2970885ffdf184
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 4A1274A3E3C14785FB22BA15E09467BF663EB44754FE84035D699CA9C4DB7CE7808B20

Function 00007FF77C631050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF77C631098
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF77C6311F6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF77C631108
malloc, xrefs: 00007FF77C63110F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF77C6310CC
fread, xrefs: 00007FF77C6311FD
fseek, xrefs: 00007FF77C6310D3

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 8ac83016c6d19718629361c98ce183280e134061d2f39cae6ebd349d7a60620e
Instruction ID: 3df8b116d815d9678d17537c549c6dcb0a4c7630eb520bb13e888315c66f08a2
Opcode Fuzzy Hash: 8ac83016c6d19718629361c98ce183280e134061d2f39cae6ebd349d7a60620e
Instruction Fuzzy Hash: 27416263B3855241EB12FB12A8815BBE396BF8DB84FD44431ED4C87795DE3CE2458760

Function 00007FF77C631470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF77C63149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF77C6315DF
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF77C631518
malloc, xrefs: 00007FF77C63151F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF77C6314DE
fread, xrefs: 00007FF77C6315E6
fseek, xrefs: 00007FF77C6314E5

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 32ddf84ba07bcb3af5be6c29ad821ee78a82dc1a13238bf059d4699f4c578f7a
Instruction ID: f316fdd1e9b2d530c03798b782d712437283d0a0ad5b140fb5d90f127ad55efd
Opcode Fuzzy Hash: 32ddf84ba07bcb3af5be6c29ad821ee78a82dc1a13238bf059d4699f4c578f7a
Instruction Fuzzy Hash: D04183A3B3854285EB02FB21A4815BBE392EF8C794FD44532EE4D87795DE3CE6418720

Function 00007FF77C63EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF77C63EAD5

Part of subcall function 00007FF77C63FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF77C63FA6F
Part of subcall function 00007FF77C63FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF77C63FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF77C63EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF77C63EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF77C63EF08

Strings

csm, xrefs: 00007FF77C63EB56
csm, xrefs: 00007FF77C63EBD0
csm, xrefs: 00007FF77C63EAEF

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: 59c1283f52e92d9e6681d8530fb94a9bdf7b45f029f3b5ed55d8dae20ab1e420
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: 13D1A177A3874186EB22EB25D4803AEB7A1FB48798F400135EE4D97B95DF38E451C720

Function 00007FF77C632C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C633706,?,00007FF77C633804), ref: 00007FF77C632C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C633706,?,00007FF77C633804), ref: 00007FF77C632D63
MessageBoxW.USER32 ref: 00007FF77C632D99

Strings

Error, xrefs: 00007FF77C632D8C
%ls: , xrefs: 00007FF77C632D22
[PYI-%d:ERROR] , xrefs: 00007FF77C632CA6
<FormatMessageW failed.>, xrefs: 00007FF77C632D70

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: f5708d039780d66c9dc51e505d35a1713d04afc18e947e0aaf9092ff12246f05
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 0E31B723728A4142E722BB15B8802ABA797BF8C798F800135EF4DD7759DE3CD546C710

Function 00007FF77C63DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF77C63DFEA,?,?,?,00007FF77C63DCDC,?,?,?,00007FF77C63D8D9), ref: 00007FF77C63DDBD
GetLastError.KERNEL32(?,?,?,00007FF77C63DFEA,?,?,?,00007FF77C63DCDC,?,?,?,00007FF77C63D8D9), ref: 00007FF77C63DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF77C63DFEA,?,?,?,00007FF77C63DCDC,?,?,?,00007FF77C63D8D9), ref: 00007FF77C63DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF77C63DFEA,?,?,?,00007FF77C63DCDC,?,?,?,00007FF77C63D8D9), ref: 00007FF77C63DE63
GetProcAddress.KERNEL32(?,?,?,00007FF77C63DFEA,?,?,?,00007FF77C63DCDC,?,?,?,00007FF77C63D8D9), ref: 00007FF77C63DE6F

Strings

api-ms-, xrefs: 00007FF77C63DDDD

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: 7c1395ff52bb0383653c103124299ef6361d0c6233014f41a5557aa0bc79997d
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: B0317022B3A64291EF13BB02A880576A795FF5CBA4F994535EE1D87384EF3CE4458324

Function 00007FF77C636350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF77C6363B7
ucrtbase.dll, xrefs: 00007FF77C6363CD
Failed to load Python DLL '%ls'., xrefs: 00007FF77C636497
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF77C636446
LoadLibrary, xrefs: 00007FF77C63649E
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF77C6363F7

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
Instruction ID: 326f31c9b6eccc8d91287921d9b1f57975db1fd3647c90b0526bfac092f4af95
Opcode Fuzzy Hash: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
Instruction Fuzzy Hash: C5412022B3868691EB12EB15E4941EBA322FF5C354FD04132EA5D83696EF3CE515C760

Function 00007FF77C632A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF77C63351A,?,00000000,00007FF77C633F23), ref: 00007FF77C632AA0

Strings

Warning, xrefs: 00007FF77C632B1E
WARNING, xrefs: 00007FF77C632AAF
Warning [ANSI Fallback], xrefs: 00007FF77C632B0F
0, xrefs: 00007FF77C632B16
[PYI-%d:%s] , xrefs: 00007FF77C632AA8

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 0c7eaf926f917a2dc6b1bdf557cbfa568e0ea31aca9bcd9739f1c98dfa5c6bc4
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: BC217F73B38B8192E722EB51B8817E7A395BB88784F800132FE8C93659DF3CD2458650

Function 00007FF77C64B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF77C64B1CF
FlsGetValue.KERNEL32 ref: 00007FF77C64B1E4
FlsSetValue.KERNEL32 ref: 00007FF77C64B205
FlsSetValue.KERNEL32 ref: 00007FF77C64B232
FlsSetValue.KERNEL32 ref: 00007FF77C64B243
FlsSetValue.KERNEL32 ref: 00007FF77C64B254
SetLastError.KERNEL32 ref: 00007FF77C64B26F

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction ID: 10ad2220ca5c5e41b241893cb13ff3311d6c512e72b1bfdc0d6b04a16c043729
Opcode Fuzzy Hash: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction Fuzzy Hash: AF213626A3C60241FB5A77A196E113FF1535F8CBA0F944634DD3E8AAD6DE2CA7018321

Function 00007FF77C657DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF77C657E0D
GetLastError.KERNEL32 ref: 00007FF77C657E19
CloseHandle.KERNEL32 ref: 00007FF77C657E31
CreateFileW.KERNEL32 ref: 00007FF77C657E5C
WriteConsoleW.KERNEL32 ref: 00007FF77C657E7B

Strings

CONOUT$, xrefs: 00007FF77C657E3D

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: f73039f58a69863f39feb8ae68b61f6f28157fd86224e2d3a971d63c839ef94b
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: 3A117222738B4186E351AB52B89433AB3A1BB8CBE4F900234DE5DC7794DF3CD9048750

Function 00007FF77C638560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF77C639216), ref: 00007FF77C638592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF77C639216), ref: 00007FF77C6385E9

Part of subcall function 00007FF77C639400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF77C6345E4,00000000,00007FF77C631985), ref: 00007FF77C639439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF77C639216), ref: 00007FF77C638678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF77C639216), ref: 00007FF77C6386E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF77C639216), ref: 00007FF77C6386F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF77C639216), ref: 00007FF77C63870A

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction ID: 28527531bd5f85a04fb5933b420b89bcca8cf4e0eab7c35c7a94e4ab62da60cb
Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction Fuzzy Hash: FB419363B3868241EB71AB11A5846ABA3A6FF8CBD4F840136DF4D97785DE3CD501C720

Function 00007FF77C64B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA,?,?,?,?,00007FF77C6471FF), ref: 00007FF77C64B347
FlsSetValue.KERNEL32(?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA,?,?,?,?,00007FF77C6471FF), ref: 00007FF77C64B37D
FlsSetValue.KERNEL32(?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA,?,?,?,?,00007FF77C6471FF), ref: 00007FF77C64B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA,?,?,?,?,00007FF77C6471FF), ref: 00007FF77C64B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA,?,?,?,?,00007FF77C6471FF), ref: 00007FF77C64B3CC
SetLastError.KERNEL32(?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA,?,?,?,?,00007FF77C6471FF), ref: 00007FF77C64B3E7

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction ID: 4a48cffebe2a61792af35a5b47116c16b9f54490f83de3da2488f702f71ec4a4
Opcode Fuzzy Hash: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction Fuzzy Hash: 5011F826A3CA4282F757776296D113BF1535F8C7A0B944634DA2ECA6D6DE2CA6018321

Function 00007FF77C632910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF77C631B6A), ref: 00007FF77C63295E

Strings

Error, xrefs: 00007FF77C632A0E
Error [ANSI Fallback], xrefs: 00007FF77C6329FF
%s: %s, xrefs: 00007FF77C6329E8
[PYI-%d:ERROR] , xrefs: 00007FF77C632966

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: 105a4c1febf8c39f9db4202fafb4e3b4aec72b4930ae7482d285028f2be29461
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: 6031A463B3868152E711A761B8816E7A296BF8C7D4F804132EE8DD3759EF3CD6468610

Function 00007FF77C632390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF77C6323C8
DialogBoxIndirectParamW.USER32 ref: 00007FF77C63248E
DeleteObject.GDI32 ref: 00007FF77C6324C1
DestroyIcon.USER32 ref: 00007FF77C6324D3

Strings

Unhandled exception in script, xrefs: 00007FF77C6323F8

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction ID: 155bd523d157080d4b4985a794b797d2d676d0096d09bd0851a4e3d1e9af62d7
Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction Fuzzy Hash: C8313273A3968189EB21AB21F8951FAA351FF8C784F940135EA4D8BA5ADF3CD105C710

Function 00007FF77C632B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF77C63918F,?,00007FF77C633C55), ref: 00007FF77C632BA0
MessageBoxW.USER32 ref: 00007FF77C632C2A

Strings

Warning, xrefs: 00007FF77C632C1D
WARNING, xrefs: 00007FF77C632BAF
[PYI-%d:%ls] , xrefs: 00007FF77C632BA8

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: 711aac08c0f227ce4375ae82fe57499654687c397f11fe70bf9d22112f3eba4f
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: 1921D373728B4192E712AB14F4807ABB3A5EB8C784F804132EE8D97659DF3CD205C710

Function 00007FF77C632710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF77C631B99), ref: 00007FF77C632760

Strings

Error, xrefs: 00007FF77C6327DE
Error [ANSI Fallback], xrefs: 00007FF77C6327CF
ERROR, xrefs: 00007FF77C63276F
[PYI-%d:%s] , xrefs: 00007FF77C632768

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: 8e80d50c27a1b9f8f1a4797e9bf0ce19e3fa21fd2c4b938532dde35ea3163f2a
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: 17217F73B38B8192E721EB50B8817E7A3A5AB8C384F800132FE8D93659DF3CD2458750

Function 00007FF77C649AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF77C649B1D
GetProcAddress.KERNEL32 ref: 00007FF77C649B33
FreeLibrary.KERNEL32 ref: 00007FF77C649B5A

Strings

CorExitProcess, xrefs: 00007FF77C649B2C
mscoree.dll, xrefs: 00007FF77C649B14

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: 9ced3c645f015e697a5780e9d48ce8881e89055408235c85ab89a4174471f434
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: 75F0C822B3870681EB11AB10E4C473BA322AF8C765F940235CA6DC61F4DF2CD144C760

Function 00007FF77C6593D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF77C659400
_set_statfp.LIBCMT ref: 00007FF77C65941B
_set_statfp.LIBCMT ref: 00007FF77C659437
_set_statfp.LIBCMT ref: 00007FF77C659473

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: c1bccfd014470de4f93a445bf6febcdfd3de8bd4f414ac617918c4f9659566c7
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: A711BF63F3CA1301FB663124F5D6377A0476F5C360EA40634EB6EC62D6AE2CAC438120

Function 00007FF77C64B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF77C64A613,?,?,00000000,00007FF77C64A8AE,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64B41F
FlsSetValue.KERNEL32(?,?,?,00007FF77C64A613,?,?,00000000,00007FF77C64A8AE,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64B43E
FlsSetValue.KERNEL32(?,?,?,00007FF77C64A613,?,?,00000000,00007FF77C64A8AE,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64B466
FlsSetValue.KERNEL32(?,?,?,00007FF77C64A613,?,?,00000000,00007FF77C64A8AE,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64B477
FlsSetValue.KERNEL32(?,?,?,00007FF77C64A613,?,?,00000000,00007FF77C64A8AE,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64B488

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction ID: c5bef97d19db0611c37f6753456b20e2e42877948ced5a7867b92fcfcbd1940a
Opcode Fuzzy Hash: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction Fuzzy Hash: FD114D36A38A0241FB5AB36595D117BF1535F8C7B0F848334D82DCA6DADE2CE7028721

Function 00007FF77C64B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF77C64B2A5
FlsSetValue.KERNEL32 ref: 00007FF77C64B2C4
FlsSetValue.KERNEL32 ref: 00007FF77C64B2EC
FlsSetValue.KERNEL32 ref: 00007FF77C64B2FD
FlsSetValue.KERNEL32 ref: 00007FF77C64B30E

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction ID: edbe6294b333b6ed2f12b73631b5c1f2b24e4e87b45380b3f23166e9f87ceedd
Opcode Fuzzy Hash: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction Fuzzy Hash: 9211D226A3860641FB5A73A284A117BB1534F8D720F885734D92E8E2C2DD2CA7025222

Function 00007FF77C646010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C646176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64622C

Strings

verbose, xrefs: 00007FF77C646020

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: c0937a6d003a2bc45d3255ea6de0033a3cd4150c306ce904a5500011a30514df
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 8591B673A3CA4691F762AF24D4903BFB692AB48B54FC44136DA498B3D5DE3CE7458320

Function 00007FF77C64FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64FF17

Part of subcall function 00007FF77C647AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C647AC9

Strings

UTF-16LEUNICODE, xrefs: 00007FF77C64FEB5
ccs, xrefs: 00007FF77C64FE52
UTF-8, xrefs: 00007FF77C64FE96

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: 52a6b65dd5cc80f40b595ec834c58158d6b3d525f66e6237ecdbe51c83c78dea
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 7B81B333D3824395F7A66E25818067BB6E3AB19748FD54035DA09DF285DF2DE7028323

Function 00007FF77C63D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF77C63D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF77C63D77A
RtlUnwindEx.KERNEL32 ref: 00007FF77C63D7D4

Strings

csm, xrefs: 00007FF77C63D761

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: 6965e2ac0e314fd2add5ffe01aa573cb129229d4cc9183fb06e58b3baa733d64
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 45518333B396018ADB15EB15D494A7AB7A2EB48B98F904134DF4E87784DF7CE841C710

Function 00007FF77C63EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF77C63EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF77C63EFF3

Strings

RCC, xrefs: 00007FF77C63EFC3
MOC, xrefs: 00007FF77C63EFBB

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: a2a02dfb21cc193966ec202216a771b008e98c3e8b6102a07628f7df882fbbf0
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 4E61AF33928BC581EB61AB15E4807AAF7A1FB88B84F444235EB9C47B95CF7CD194CB11

Function 00007FF77C63F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF77C63F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF77C63F408

Strings

csm, xrefs: 00007FF77C63F342
csm, xrefs: 00007FF77C63F45A

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: d693e4f61bb5b1242a56cebd355170672a6e035f31b01394ff97e53c60670301
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: 0C51A23393824286EF65AE21908436AB692FB58B94F944175EA4D87796CF3CE450C722

Function 00007FF77C632810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF77C6328EA

Strings

ERROR, xrefs: 00007FF77C63286F
Error, xrefs: 00007FF77C6328DD
[PYI-%d:%ls] , xrefs: 00007FF77C632868

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: 1b4244a08fd30e2f190c53808feb9a4b1aee219eb70209380e508cd193ebd343
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: CF21B173B28B4192E712AB14B4807ABB3A1EB8C780F804132EE8D9765ADE3CD245C710

Function 00007FF77C64C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF77C64C68F
WriteFile.KERNEL32 ref: 00007FF77C64C957
WriteFile.KERNEL32 ref: 00007FF77C64C99D
GetLastError.KERNEL32 ref: 00007FF77C64CA53

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: c7ab6ffb38eee2db5e57db636f10ec2fcfe27a63951b347fa77dbfaa6c59ab3a
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: 97D13673B38A409AE712DF65D4801AD7772FB487D8B808235DE5E9BB89DE38D246C350

Function 00007FF77C6320C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF77C6320F4
SetWindowLongPtrW.USER32 ref: 00007FF77C632116
GetWindowLongPtrW.USER32 ref: 00007FF77C632140
InvalidateRect.USER32 ref: 00007FF77C632160

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: a1498169c64d959caea6e3caa2f081938b0370d7bf5f5b8b8bbd49c28f050398
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 28117332B3C14242F756A769B6C427B9393EF8C780FD48030DF4946B9ACD2DD5958224

Function 00007FF77C655B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77C6517D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C651803

_get_daylight.LIBCMT ref: 00007FF77C655CA4
_get_daylight.LIBCMT ref: 00007FF77C655CB5

Strings

?, xrefs: 00007FF77C655C35

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction ID: 88d2bcf0ecf928fac81b21821be19b5a10c2a475332170f567da06d6ff908be3
Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction Fuzzy Hash: A8414E13B38A8241F7226715F48937BE652EB84BA4F60423AFF5C86AD9DE3CD441C710

Function 00007FF77C649084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6490B6

Part of subcall function 00007FF77C64A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9CE
Part of subcall function 00007FF77C64A9B8: GetLastError.KERNEL32(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF77C63CC15), ref: 00007FF77C6490D4

Strings

C:\Users\user\Desktop\lz4wnSavmK.exe, xrefs: 00007FF77C6490C2

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\lz4wnSavmK.exe
API String ID: 3580290477-2746711996
Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction ID: 0884d2bb8c2d310e2fbb5d8fd1a69ee41a417566bbc2a288e83b60453dedf8ae
Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction Fuzzy Hash: EA418133A38A02C5E716BF2595C14BEB396EB4CBC4BD54035E94D8BB85DE3DD6818320

Function 00007FF77C64CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF77C64CDBF
GetLastError.KERNEL32 ref: 00007FF77C64CDE1

Strings

U, xrefs: 00007FF77C64CD6B

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: 3bf149a663416871a8e823433cc20b563adee1bb7297b462979e70c55afafde2
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: B141A323B38A5191DB219F25E4843AAB7A1FB98794F904131EE4DC7798EF3CD601C750

Function 00007FF77C64F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF77C64F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF77C64F6BA

Strings

:, xrefs: 00007FF77C64F67E

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction ID: 8f8071e2971c9675147a6b75bf268c6153d44a2a205b82484bad481a81a6b509
Opcode Fuzzy Hash: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction Fuzzy Hash: 0C21B163A3868182EB22AB11D48426EB3A3FB8CB44FD54035DA8C87694DF7CD7458B61

Function 00007FF77C63FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF77C63FE08
RaiseException.KERNEL32 ref: 00007FF77C63FE49

Strings

csm, xrefs: 00007FF77C63FE36

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: 665d6b28388d0edd8538baf9d53b4f6abdfb3a9500b757e5eb582e0cd4a00c8c
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: 8D112E32628B8582EB629F15F44026AB7E5FB8CB84F984270DF8D47759DF3CD5518B10

Function 00007FF77C6507AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6507DC
GetDriveTypeW.KERNEL32 ref: 00007FF77C65081C

Strings

:, xrefs: 00007FF77C650805

Memory Dump Source

Source File: 00000000.00000002.1799355307.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000000.00000002.1799335960.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799386721.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799415121.00007FF77C672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799457501.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: c656d7984cd14de5c632a01b0ede08d5dc3cad7d8b4d8280c2711c614798db73
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: 33012523A3C60385F772BF60A4A627FB6A1EF4C748FD40435D64DC6691EE3CE5448A24

Analysis Process: lz4wnSavmK.exePID: 7300, Parent PID: 7252COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.3%
Total number of Nodes:	633
Total number of Limit Nodes:	7

Executed Functions

Function 00007FF77C631000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-python-flag, xrefs: 00007FF77C633AD6
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF77C633A0B, 00007FF77C633CD4, 00007FF77C633F6B
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF77C633EA6
Failed to convert DLL search path!, xrefs: 00007FF77C633DDC
pyi-disable-windowed-traceback, xrefs: 00007FF77C633BB2
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF77C633971
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF77C633C61
pyi-runtime-tmpdir, xrefs: 00007FF77C633B68
Failed to load splash screen resources!, xrefs: 00007FF77C633E85
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF77C6339DE
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF77C633882, 00007FF77C6338AF
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF77C633EBB
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF77C633E0A
_PYI_SPLASH_IPC, xrefs: 00007FF77C633A23, 00007FF77C633EF5
Failed to remove temporary directory: %s, xrefs: 00007FF77C633FC3
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF77C633D35
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF77C633A17, 00007FF77C633A2F, 00007FF77C633A9B
Could not create temporary directory!, xrefs: 00007FF77C633CBF
Py_GIL_DISABLED, xrefs: 00007FF77C633AF4
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF77C633B32
_PYI_ARCHIVE_FILE, xrefs: 00007FF77C6338D2, 00007FF77C6339FF
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF77C633BE8
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF77C633D12
MEI, xrefs: 00007FF77C633933
VCRUNTIME140.dll, xrefs: 00007FF77C633DB1
Failed to start splash screen!, xrefs: 00007FF77C633ED4
pyi-contents-directory, xrefs: 00007FF77C633B8D
pkg, xrefs: 00007FF77C6339BE

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: c4287787c746abb56e9331fa3c8956d7c4ae80ab217cba986f551fa52fb8bac5
Instruction ID: 9114c02e35f4c945f3e564d6bb4ac957497460a2e6caa7a6b363cd5af0fa4c48
Opcode Fuzzy Hash: c4287787c746abb56e9331fa3c8956d7c4ae80ab217cba986f551fa52fb8bac5
Instruction Fuzzy Hash: E1325E23A3C68251EB17BB2194D52BBA693AF9C740FC44036DA5DC72D6EF2CE556C320

Function 00007FF77C6569D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF77C656708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C656749
Part of subcall function 00007FF77C656708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6567C7
Part of subcall function 00007FF77C656708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C656818

CreateFileW.KERNEL32 ref: 00007FF77C656ADA
CreateFileW.KERNEL32 ref: 00007FF77C656B2A
GetLastError.KERNEL32 ref: 00007FF77C656B5A
GetFileType.KERNEL32 ref: 00007FF77C656B6F
GetLastError.KERNEL32 ref: 00007FF77C656B79
CloseHandle.KERNEL32 ref: 00007FF77C656BAC
CloseHandle.KERNEL32 ref: 00007FF77C656D0F
CreateFileW.KERNEL32 ref: 00007FF77C656D44
GetLastError.KERNEL32 ref: 00007FF77C656D53

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: 6e974f1467f80e3e32f6f854cc6697c8b9e4dcbf63594fe474f39d4998d22fe0
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 8CC1DF37B38A4185EB51EF64D4812AE7762EB88B98B914225DF2E9B394CF38D151C310

Function 00007FF77C6392F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF77C639323
FindClose.KERNEL32 ref: 00007FF77C639332

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: 2ee977b4d359e8598270d5b5f578115adeef70896603c7c67b083c718fa6027b
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: D9F0C863A38741C6F7B19B60B4C8777B351AB8C328F880335DAAD466D4DF3CD0588A10

Function 00007FFDFAC20180 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FFDFAC201A5

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: b0054afb10e4f66619171edf603becae74e7afe6d3d72f3cb96377bce576b712
Instruction ID: f890f8d547d6e6f0a21cac0c4219e8c852f9672c751d88292213934fe50201af
Opcode Fuzzy Hash: b0054afb10e4f66619171edf603becae74e7afe6d3d72f3cb96377bce576b712
Instruction Fuzzy Hash: 00A1D968B0EB4786EF5C8B45A874B3823E0FF54B44F5905B6CD6D077E8EF6CA9558200

Function 00007FF77C631950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF77C637F80: _fread_nolock.LIBCMT ref: 00007FF77C63802A

_fread_nolock.LIBCMT ref: 00007FF77C631A1B

Part of subcall function 00007FF77C632910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF77C631B6A), ref: 00007FF77C63295E

Strings

Could not allocate buffer for TOC!, xrefs: 00007FF77C631B1B
fread, xrefs: 00007FF77C631A32, 00007FF77C631B5C
Could not read full TOC!, xrefs: 00007FF77C631B55
malloc, xrefs: 00007FF77C631B22
MEI, xrefs: 00007FF77C631991
Error on file., xrefs: 00007FF77C631B8D
fseek, xrefs: 00007FF77C6319F5
Failed to seek to cookie position!, xrefs: 00007FF77C6319EE
calloc, xrefs: 00007FF77C631A68
Could not allocate memory for archive structure!, xrefs: 00007FF77C631A61
Failed to read cookie!, xrefs: 00007FF77C631A2B

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 2905f55c1a3c8d4e6aa49aeeb86a9490fcb65926af6803c34ddd16b54d0a65e3
Instruction ID: 35c52bdfd9152fee9e3d00afc52d1cfae8b5c8307c3428e46191c0d58e939bc0
Opcode Fuzzy Hash: 2905f55c1a3c8d4e6aa49aeeb86a9490fcb65926af6803c34ddd16b54d0a65e3
Instruction Fuzzy Hash: 098182B3A3C68685E752BB14E4812BBA3A2EF8C744FD04431DA8DC7795DE3CE6458760

Function 00007FF77C631470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF77C6314DE
Failed to extract %s: failed to open archive file!, xrefs: 00007FF77C63149F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF77C631518
fread, xrefs: 00007FF77C6315E6
malloc, xrefs: 00007FF77C63151F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF77C6315DF
fseek, xrefs: 00007FF77C6314E5

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: c3132dac9269c38c9a1bc21902639ef7b90e150b6d1cafd95d12fa158ba3d24b
Instruction ID: f316fdd1e9b2d530c03798b782d712437283d0a0ad5b140fb5d90f127ad55efd
Opcode Fuzzy Hash: c3132dac9269c38c9a1bc21902639ef7b90e150b6d1cafd95d12fa158ba3d24b
Instruction Fuzzy Hash: D04183A3B3854285EB02FB21A4815BBE392EF8C794FD44532EE4D87795DE3CE6418720

Function 00007FF77C631210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF77C6312BA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF77C63141E
1.3.1, xrefs: 00007FF77C631249
malloc, xrefs: 00007FF77C6312C1, 00007FF77C6312F6
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF77C6312EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF77C631276

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: c071fae04400aaba9d8a24e5b62ce610f1ca997db65dc53a1f24edd26e5d05d7
Instruction ID: 449d78a6db43a6b6a4126bdaed83cf8eacd26779eeb93c9f080bc59d0a17e770
Opcode Fuzzy Hash: c071fae04400aaba9d8a24e5b62ce610f1ca997db65dc53a1f24edd26e5d05d7
Instruction Fuzzy Hash: EE51B563A3864245E762BB11A4903BBE292BF89794FD44135EE4E877C6DE3CE6418720

Function 00007FF77C6336B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF77C633804), ref: 00007FF77C6336E1
GetLastError.KERNEL32(?,00007FF77C633804), ref: 00007FF77C6336EB

Part of subcall function 00007FF77C632C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C633706,?,00007FF77C633804), ref: 00007FF77C632C9E
Part of subcall function 00007FF77C632C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C633706,?,00007FF77C633804), ref: 00007FF77C632D63
Part of subcall function 00007FF77C632C50: MessageBoxW.USER32 ref: 00007FF77C632D99

Strings

Failed to obtain executable path., xrefs: 00007FF77C6336F3
GetModuleFileNameW, xrefs: 00007FF77C6336FA
Failed to resolve full path to executable %ls., xrefs: 00007FF77C633739
\\?\, xrefs: 00007FF77C63375A
Failed to convert executable path to UTF-8., xrefs: 00007FF77C633790

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: 06af7d9a094265e26c22c70e98f3d0bffe1b72df2d7041147b00421daf22a886
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 90217463B3C54291FB22B721E8943B7A262BF9C394FD04132EA5DC66D5EE2CE505C724

Function 00007FF77C64BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64BEF9

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
Instruction ID: 72343e9ac82cd5047bbc8b378b984324359da8c0ad43e2cdb456e8fcb7a1e565
Opcode Fuzzy Hash: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
Instruction Fuzzy Hash: C6C1D52393CA8691E7526B55D0806BFB792EBC9B80FD54131EE4D8B791CE7CE7458320

Function 00007FF77C636350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF77C636446
ucrtbase.dll, xrefs: 00007FF77C6363CD
LoadLibrary, xrefs: 00007FF77C63649E
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF77C6363F7
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF77C6363B7
Failed to load Python DLL '%ls'., xrefs: 00007FF77C636497

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction ID: 326f31c9b6eccc8d91287921d9b1f57975db1fd3647c90b0526bfac092f4af95
Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction Fuzzy Hash: C5412022B3868691EB12EB15E4941EBA322FF5C354FD04132EA5D83696EF3CE515C760

Function 00007FF77C645698 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6456C5
CreateFileW.KERNEL32 ref: 00007FF77C645704
CloseHandle.KERNEL32 ref: 00007FF77C645739

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: 6b2031f2022a60333ae8fa073d7710fa471f9d5118068ebb59b7a18e2bb2e1c5
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: C641B433D38B8183E351EB20959037AB261FB98764F509334EA5C47AD6DF6CA7E08720

Function 00007FF77C63CCAC Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF77C63CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF77C63CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF77C63CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF77C63CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF77C63CD91

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 3c75460419d0a6bd819aa20e2bffc3bbfbe21fee87ce08a626a3ed1afae0dc49
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: C1313823E7851255FB27BB2498913BBA683AF49384FD44534FA0DCB2D7DE2CA505C270

Function 00007FF77C6401AC Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6401F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6402E7

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: 35161f00ceea5db8d4f734909a7fbe4a85e0f33642812b5ab0d2d79bb5a6cf21
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: 7F512B2373D26286E727BA65948067BB583AF4CBA4F944230DE6D8B7C5CF3CD7018620

Function 00007FF77C64C1A4 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF77C64C33D), ref: 00007FF77C64C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF77C64C33D), ref: 00007FF77C64C1FA

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 12cc33ef135ed66a18025d4f413e7e3b6aba7442d071318187ee3e8eb1d6db66
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 1611C862738A8181DB119B25B49416AB352FB89BF4F944331EE7D8B7D5CE7CD2118700

Function 00007FF77C64A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9CE
GetLastError.KERNEL32(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9D8

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: fed10fb103d6477cc030b2ddc0bbe0c8510855317c9b2dfa37a530ce330f7167
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 66E0BF52F3960252FF167BB264D617BA2536FCC740BC54434DA1DDA2A2DE2CAA858220

Function 00007FF77C64ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF77C64AA45,?,?,00000000,00007FF77C64AAFA), ref: 00007FF77C64AC36
GetLastError.KERNEL32(?,?,?,00007FF77C64AA45,?,?,00000000,00007FF77C64AAFA), ref: 00007FF77C64AC40

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: b1524c1358b2d25084c8c5301f31bbd33835f4cff8a29cb184a56de0c9176cb3
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 14215313B3C64251EB967761A4D127FA6839F8CB90F984235DA1ECB7C2CE6CE7454310

Function 00007FF77C64BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64BF44

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: 313c2e9e3f84f81d07dcb7a95320bdcaaa8fd6e8f9c99358a15c186b3d1f4e4b
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: D841E83393860187EB75EB55E58017BB3A2EB59B45F900131DA8DCB691CF2DE702CB61

Function 00007FF77C637F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF77C63802A

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 9578cb62be41ca4d18d42ef1f4825d70acfd7f05a5d28fd673b41da833071700
Instruction ID: e3ed3fa545c1b11e1a67dfdd069fd642da0a6efdd0b6c3f98ac237d2d5f8f01f
Opcode Fuzzy Hash: 9578cb62be41ca4d18d42ef1f4825d70acfd7f05a5d28fd673b41da833071700
Instruction Fuzzy Hash: B7215022B3865145EB52BA1265843FBE652BF4DBC4FC84431EE4D8B786CF3DE2418710

Function 00007FF77C64B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64BA32

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction ID: 3d36fddc3f7c395abd5bcc2371566757168ab19091f844517a99fa8964755f9f
Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction Fuzzy Hash: 2E318123A38A4285E7537B95C48227EB652EB88B94FC54135E91D8B3D2CE7CE7818730

Function 00007FF77C646004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C645F69

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 9f4381dc3d53c78282251c2d9cc7030f33228ae357ad646e0d8d3cb9feac2e3d
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: E3111233938A4141EBA27E51944117FF265AF49B84FC44031EE4C9BA9ADF3DD7418B22

Function 00007FF77C6563C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6563E7

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 0fdeabe8b31d1c91d4da5585757769e766ca67f3e93f2c05b57d9ea6e98d6b20
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 4621447363864286D762AF18E48037AB662EB88B94FA45234D75DC77D5DF3CD501CB10

Function 00007FF77C64042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C640480

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 91d204855f39683eabb33912eac4b5b170ee622047d929826912eb00450ae69e
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 6F018223A3875180EB06FF52594106AF692AF89FE0B984631DE5C9BBDACE3CD3014710

Function 00007FF77C639070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77C639400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF77C6345E4,00000000,00007FF77C631985), ref: 00007FF77C639439

LoadLibraryExW.KERNEL32(?,00007FF77C636466,?,00007FF77C63336E), ref: 00007FF77C639092

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction ID: d36291a567ee8df9dc32b7ebad419c6e623dfc8fec9e4ef1b49432d29ab2a195
Opcode Fuzzy Hash: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction Fuzzy Hash: 60D08C12B3424642EB95B767BA8663A9252AFCDBC0F988035EE0D47B4AEC3CC0414B00

Function 00007FF77C64EC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF77C64B39A,?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA), ref: 00007FF77C64EC5D

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction ID: bd2e7b21759556caa03de58cd3f70ddbbed8d86597f48a0ed6911e2e873c806f
Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction Fuzzy Hash: 98F04F5AB3920640FF567A6254D12B7E2825F8CB80FCC5430C91DCE2D1ED1CA7914230

Function 00007FF77C64D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF77C640D00,?,?,?,00007FF77C64236A,?,?,?,?,?,00007FF77C643B59), ref: 00007FF77C64D6AA

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 71995121434ff04a94afeb5904bb1de097200a28953701fc6daf20953cc25ded
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 78F0DA12F3924645FF967B619891677A2925F9DBA0F880630AE2EC92D5DE2CA7408530

Non-executed Functions

Function 00007FFE013E3B10 Relevance: 101.8, APIs: 46, Strings: 12, Instructions: 278COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFE013E3B6A
CRYPTO_realloc.LIBCRYPTO-3 ref: 00007FFE013E3B8D
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3B97
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013E3BAF
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013E3BC0
memset.VCRUNTIME140 ref: 00007FFE013E3BF3
OSSL_PARAM_locate_const.LIBCRYPTO-3 ref: 00007FFE013E3C1E
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013E3C47
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3C54
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013E3C6C
OSSL_PARAM_locate_const.LIBCRYPTO-3 ref: 00007FFE013E3C85
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013E3CAE
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3CBC
OSSL_PARAM_locate_const.LIBCRYPTO-3 ref: 00007FFE013E3CD2
OSSL_PARAM_locate_const.LIBCRYPTO-3 ref: 00007FFE013E3D12
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013E3D3B
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3D49
OSSL_PARAM_locate_const.LIBCRYPTO-3 ref: 00007FFE013E3D62
OSSL_PARAM_get_uint.LIBCRYPTO-3 ref: 00007FFE013E3D77
OSSL_PARAM_locate_const.LIBCRYPTO-3 ref: 00007FFE013E3D8E
OSSL_PARAM_get_uint.LIBCRYPTO-3 ref: 00007FFE013E3DA0
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3DB2
OSSL_PARAM_locate_const.LIBCRYPTO-3 ref: 00007FFE013E3DD4
OSSL_PARAM_locate_const.LIBCRYPTO-3 ref: 00007FFE013E3E00
OSSL_PARAM_get_int.LIBCRYPTO-3 ref: 00007FFE013E3E15
OSSL_PARAM_locate_const.LIBCRYPTO-3 ref: 00007FFE013E3E2C
OSSL_PARAM_get_int.LIBCRYPTO-3 ref: 00007FFE013E3E41
OSSL_PARAM_locate_const.LIBCRYPTO-3 ref: 00007FFE013E3E54
OSSL_PARAM_get_int.LIBCRYPTO-3 ref: 00007FFE013E3E65
ERR_set_mark.LIBCRYPTO-3 ref: 00007FFE013E3E74
EVP_KEYMGMT_free.LIBCRYPTO-3 ref: 00007FFE013E3EAE
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFE013E3EB3
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3EBD
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3EC9
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3ED5
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3EE1
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3EED
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3EF9
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3F05
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3F11
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3F1D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013E3F35
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013E3F46
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013E3F60
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013E3F76
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013E3F8C

Strings

tls-group-name-internal, xrefs: 00007FFE013E3C7B
tls-max-dtls, xrefs: 00007FFE013E3E4A
tls-min-tls, xrefs: 00007FFE013E3DC7
add_provider_groups, xrefs: 00007FFE013E3B9C, 00007FFE013E3C5E, 00007FFE013E3F27
tls-group-is-kem, xrefs: 00007FFE013E3D84
tls-group-id, xrefs: 00007FFE013E3CC8
tls-group-alg, xrefs: 00007FFE013E3D04
tls-max-tls, xrefs: 00007FFE013E3DF6
tls-group-sec-bits, xrefs: 00007FFE013E3D58
tls-group-name, xrefs: 00007FFE013E3C05
tls-min-dtls, xrefs: 00007FFE013E3E22
..\s\ssl\t1_lib.c, xrefs: 00007FFE013E3B5E, 00007FFE013E3B78, 00007FFE013E3BA8, 00007FFE013E3C3A, 00007FFE013E3C65, 00007FFE013E3CA1, 00007FFE013E3D2E, 00007FFE013E3F2E, 00007FFE013E3F53, 00007FFE013E3F69, 00007FFE013E3F7F

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_new$M_locate_const$M_get_intO_freeO_strdupR_set_debug$M_get_uintR_set_error$O_mallocO_reallocR_pop_to_markR_set_markT_freememset
String ID: ..\s\ssl\t1_lib.c$add_provider_groups$tls-group-alg$tls-group-id$tls-group-is-kem$tls-group-name$tls-group-name-internal$tls-group-sec-bits$tls-max-dtls$tls-max-tls$tls-min-dtls$tls-min-tls
API String ID: 1308757171-3546839243
Opcode ID: 27202393e125a86cbc6d9cf61914cc3cec450e5e6dabe12e917f6f2b2a7d7b76
Instruction ID: 0a9de035ab8d264b0384cbc8b825bca688a28043a259419524cf75856cefe21c
Opcode Fuzzy Hash: 27202393e125a86cbc6d9cf61914cc3cec450e5e6dabe12e917f6f2b2a7d7b76
Instruction Fuzzy Hash: 88C13961E0D70292FF64AB61D4812BD13E2EFA4794F854432E94D0F6FADE7CE486C212

Function 00007FFE013DBD80 Relevance: 79.0, APIs: 43, Strings: 2, Instructions: 248COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBDE5
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBDFD
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBE0B
OPENSSL_sk_num.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBE2B
OPENSSL_sk_value.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBE39
OPENSSL_sk_num.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBE65
X509_get_pubkey.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBE79
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBEAF
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBEC7
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBED8
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBEE2
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBEFA
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBF09
EVP_PKEY_missing_parameters.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBF16
EVP_PKEY_missing_parameters.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBF22
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBF2B
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBF43
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBF54
EVP_PKEY_copy_parameters.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBF64
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBF6D
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBF85
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBF96
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DBFFF
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DC017
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DC028
EVP_PKEY_free.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE013DB047), ref: 00007FFE013DC198

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFE013DBDF6, 00007FFE013DBEC0, 00007FFE013DBEF3, 00007FFE013DBF3C, 00007FFE013DBF7E, 00007FFE013DBFC9, 00007FFE013DC010, 00007FFE013DC073, 00007FFE013DC0BD
ssl_set_cert_and_key, xrefs: 00007FFE013DBDEA, 00007FFE013DBEB4, 00007FFE013DBEE7, 00007FFE013DBF30, 00007FFE013DBF72, 00007FFE013DBFBD, 00007FFE013DC004, 00007FFE013DC067, 00007FFE013DC0B1

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$L_sk_numY_missing_parameters$L_sk_valueX509_get_pubkeyY_copy_parametersY_free
String ID: ..\s\ssl\ssl_rsa.c$ssl_set_cert_and_key
API String ID: 1144767644-2212061476
Opcode ID: e58b86f3c5db015dd80eb7b45485d5ae40c5736b81e19134fb3d4453b5fcbb15
Instruction ID: 236fe0cd2c70f93de176b5c0084a41c75fe6a7d31554309a355924fcab3d0f37
Opcode Fuzzy Hash: e58b86f3c5db015dd80eb7b45485d5ae40c5736b81e19134fb3d4453b5fcbb15
Instruction Fuzzy Hash: 2BB18331A1855292EB50EB21E8916FD5351FF95B84F910132E94E4BBF6DF3CE546C302

Function 00007FF77C638BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77C639400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF77C6345E4,00000000,00007FF77C631985), ref: 00007FF77C639439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638C46

Part of subcall function 00007FF77C64A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64A500

Part of subcall function 00007FF77C64878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6487F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638CD6
CreateProcessW.KERNEL32 ref: 00007FF77C638D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638D18

Part of subcall function 00007FF77C632C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C633706,?,00007FF77C633804), ref: 00007FF77C632C9E
Part of subcall function 00007FF77C632C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C633706,?,00007FF77C633804), ref: 00007FF77C632D63
Part of subcall function 00007FF77C632C50: MessageBoxW.USER32 ref: 00007FF77C632D99

RegisterClassW.USER32 ref: 00007FF77C638D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638D7B
CreateWindowExW.USER32 ref: 00007FF77C638DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638E05
PeekMessageW.USER32 ref: 00007FF77C638E29
TranslateMessage.USER32 ref: 00007FF77C638E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638E41
PeekMessageW.USER32 ref: 00007FF77C638E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C638FF4
GetExitCodeProcess.KERNEL32 ref: 00007FF77C639009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C639012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF77C633F7F), ref: 00007FF77C63901F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF77C638D85
PyInstallerOnefileHiddenWindow, xrefs: 00007FF77C638D44
CreateProcessW, xrefs: 00007FF77C638D27
Failed to create child process!, xrefs: 00007FF77C638D20

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: 421c7c3c72bc51a63a2a49f968326013d82f4217dc18b445872b84f441ee1f53
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: CFD16133B38A8286E711AF34E8942ABB762FF8CB58F900235DE5D96694DF3CD5458710

Function 00007FFE013B1ACD Relevance: 59.9, APIs: 32, Strings: 2, Instructions: 405COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE0142BFD4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0142BFEC
CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFE0142C052
ERR_new.LIBCRYPTO-3 ref: 00007FFE0142C05F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0142C077
ERR_new.LIBCRYPTO-3 ref: 00007FFE0142C0E1
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0142C0F9
ERR_new.LIBCRYPTO-3 ref: 00007FFE0142C12D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0142C145
ERR_new.LIBCRYPTO-3 ref: 00007FFE0142C20C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0142C224
memmove.VCRUNTIME140 ref: 00007FFE0142C2BC
memmove.VCRUNTIME140 ref: 00007FFE0142C2ED
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE0142C601
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE0142C616

Strings

tls_process_client_hello, xrefs: 00007FFE0142BFD9, 00007FFE0142C064, 00007FFE0142C0E6, 00007FFE0142C137, 00007FFE0142C211, 00007FFE0142C35B, 00007FFE0142C4CB, 00007FFE0142C5BF
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFE0142BFE5, 00007FFE0142C046, 00007FFE0142C070, 00007FFE0142C0F2, 00007FFE0142C13E, 00007FFE0142C21D, 00007FFE0142C362, 00007FFE0142C4A8, 00007FFE0142C4D2, 00007FFE0142C5CB, 00007FFE0142C5F4, 00007FFE0142C60C

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug$O_freememmove$O_zalloc
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_client_hello
API String ID: 3840452407-1456301196
Opcode ID: 1eb241e59b19756535fa85d0f47608af0a49b2a9f5c839a69407715240489308
Instruction ID: 61ef16fb4dc26d0610e46c2f984327144ea971f844155e4ea1f6d171602f5266
Opcode Fuzzy Hash: 1eb241e59b19756535fa85d0f47608af0a49b2a9f5c839a69407715240489308
Instruction Fuzzy Hash: 9F02D372A18A9282EB249B21E4D02BD6751EF65780F908535DA9E0FAF5DF3CE1D1C702

Function 00007FFE01413A90 Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 207COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,00007FFE014156BD), ref: 00007FFE01413AE0
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00007FFE014156BD), ref: 00007FFE01413AF8
X509_get0_pubkey.LIBCRYPTO-3(?,?,?,?,00007FFE014156BD), ref: 00007FFE01413B2F
EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3(?,?,?,?,00007FFE014156BD), ref: 00007FFE01413B48
ERR_new.LIBCRYPTO-3(?,?,?,?,00007FFE014156BD), ref: 00007FFE01413B55
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00007FFE014156BD), ref: 00007FFE01413B6D

Strings

, xrefs: 00007FFE01413CDE
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE01413AF1, 00007FFE01413B66, 00007FFE01413B9C, 00007FFE01413DA2, 00007FFE01413DCE
tls_construct_cke_gost, xrefs: 00007FFE01413AE5, 00007FFE01413B5A, 00007FFE01413D99

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug$X509_get0_pubkeyX_new_from_pkey
String ID: $..\s\ssl\statem\statem_clnt.c$tls_construct_cke_gost
API String ID: 3869628303-1144584530
Opcode ID: 32e751c2c79760636a1aae4409ae14c57a70b1dcdf14215d076670b2ebcb5745
Instruction ID: 7e0a12c0971035995a06e51244bdac76cc0bee368196a45345d965d5b43988ff
Opcode Fuzzy Hash: 32e751c2c79760636a1aae4409ae14c57a70b1dcdf14215d076670b2ebcb5745
Instruction Fuzzy Hash: 01918B31B0868296FB64AB62E8517FE2361BF98B94F840435DE0D4F7B2EF2CE5418341

Function 00007FFE013B231F Relevance: 42.4, APIs: 20, Strings: 4, Instructions: 388COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01417AFF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01417B17
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFE01417B72
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE01417BA4
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFE01417BCD
ERR_new.LIBCRYPTO-3 ref: 00007FFE01417BEE
ERR_new.LIBCRYPTO-3 ref: 00007FFE01417C0C
EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FFE01417D4E
ERR_new.LIBCRYPTO-3 ref: 00007FFE01417D6B
ERR_new.LIBCRYPTO-3 ref: 00007FFE01417EFA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01417F12
EVP_MD_free.LIBCRYPTO-3 ref: 00007FFE01417F2E
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE01417F48

Strings

tls_process_new_session_ticket, xrefs: 00007FFE01417B09, 00007FFE01417DAE, 00007FFE01417E45, 00007FFE01417F04
SHA2-256, xrefs: 00007FFE01417D3D
resumption, xrefs: 00007FFE01417E7A
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE01417B10, 00007FFE01417B90, 00007FFE01417BAC, 00007FFE01417DBA, 00007FFE01417E51, 00007FFE01417EC1, 00007FFE01417F0B, 00007FFE01417F3B

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_new$O_freeR_set_debug$D_fetchD_freeO_malloc_time64
String ID: ..\s\ssl\statem\statem_clnt.c$SHA2-256$resumption$tls_process_new_session_ticket
API String ID: 4294151624-1635961163
Opcode ID: 820da5e7e70a9202f13f16d0803b951b2a26ae0181d167e4fbce2b6c67271352
Instruction ID: f5e72b4eba952d4dd4890ccde6b8de6dd6be1f0b50ce8449fde7bedc419da3fb
Opcode Fuzzy Hash: 820da5e7e70a9202f13f16d0803b951b2a26ae0181d167e4fbce2b6c67271352
Instruction Fuzzy Hash: 5002AD72A09B8281EB208B55E4903BD77A1FB84B95F548136EB8D4B7B6DF3CE591C700

Function 00007FFE013B144C Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFE01422011
ERR_new.LIBCRYPTO-3 ref: 00007FFE01422022
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0142203A
ERR_new.LIBCRYPTO-3 ref: 00007FFE0142206F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01422087
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFE014220A8
ERR_new.LIBCRYPTO-3 ref: 00007FFE014220EC
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01422104
ERR_new.LIBCRYPTO-3 ref: 00007FFE0142214F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01422167

Strings

tls13_save_handshake_digest_for_pha, xrefs: 00007FFE01422027, 00007FFE01422074
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFE01422033, 00007FFE01422080, 00007FFE014220FD, 00007FFE01422160, 00007FFE014221AC, 00007FFE014221F9, 00007FFE01422236
tls_process_finished, xrefs: 00007FFE014220F1, 00007FFE01422154, 00007FFE014221A0, 00007FFE014221ED, 00007FFE0142222A

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug$X_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c$tls13_save_handshake_digest_for_pha$tls_process_finished
API String ID: 1676177304-1286925996
Opcode ID: a9bf916abee2bb6894632d2fd3986c034134b2dc74cb98c7c019fb027cff6c6d
Instruction ID: 5980821a8dde322e8b26057ffebb7e638693c4b42404f667d236e69f45885395
Opcode Fuzzy Hash: a9bf916abee2bb6894632d2fd3986c034134b2dc74cb98c7c019fb027cff6c6d
Instruction Fuzzy Hash: 04A16D35A0868282F761EB61D890BFD2351EBA5B84F940036DA0D8F6F5DF7DE581C352

Function 00007FFE013B176C Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFE013DFDAA
CRYPTO_THREAD_lock_new.LIBCRYPTO-3 ref: 00007FFE013DFEA6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013DFEC7
ERR_new.LIBCRYPTO-3 ref: 00007FFE013DFECF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013DFEE7
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013DFEF8
X509_up_ref.LIBCRYPTO-3 ref: 00007FFE013DFF46
X509_chain_up_ref.LIBCRYPTO-3 ref: 00007FFE013DFF69
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013DFF97
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013DFFC5
CRYPTO_dup_ex_data.LIBCRYPTO-3 ref: 00007FFE013DFFED
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013E0013
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFE013E004C
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFE013E0091
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013E00BF
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFE013E00F4

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFE013DFD98, 00007FFE013DFEBD, 00007FFE013DFEE0, 00007FFE013DFF90, 00007FFE013DFFBE, 00007FFE013E000C, 00007FFE013E003F, 00007FFE013E0084, 00007FFE013E00B8, 00007FFE013E00E7
ssl_session_dup, xrefs: 00007FFE013DFED4

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_strdup$O_memdup$D_lock_newO_dup_ex_dataO_freeO_mallocR_newR_set_debugR_set_errorX509_chain_up_refX509_up_ref
String ID: ..\s\ssl\ssl_sess.c$ssl_session_dup
API String ID: 1347456398-2356865551
Opcode ID: a5c669e9d3f93bc523d0a6c9474b9b43ee6975909d632dbd47cf7b3b8cb64a0b
Instruction ID: b5a8dd6430e226dba609aedd8337e7a0234e997dbb9a716690fa2a47a8121442
Opcode Fuzzy Hash: a5c669e9d3f93bc523d0a6c9474b9b43ee6975909d632dbd47cf7b3b8cb64a0b
Instruction Fuzzy Hash: D7915022A09BC292EB599F60E4903BC2398FF54B44F494135EE8D1B6B6DF3CA295C310

Function 00007FFE013FFB00 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 301COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFE013FFB88
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FFB95
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FFBAD
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FFEB3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FFECB
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013FFEF5
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FFF01
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FFF19
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FFF2B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FFF43

Strings

tls_collect_extensions, xrefs: 00007FFE013FFB9A, 00007FFE013FFEB8, 00007FFE013FFF06, 00007FFE013FFF30
..\s\ssl\statem\extensions.c, xrefs: 00007FFE013FFB6E, 00007FFE013FFBA6, 00007FFE013FFEC4, 00007FFE013FFEEB, 00007FFE013FFF12, 00007FFE013FFF3C
gfffffff, xrefs: 00007FFE013FFD65
gfffffff, xrefs: 00007FFE013FFE4A
gfffffff, xrefs: 00007FFE013FFBFF
gfffffff, xrefs: 00007FFE013FFD3A

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_zalloc
String ID: ..\s\ssl\statem\extensions.c$gfffffff$gfffffff$gfffffff$gfffffff$tls_collect_extensions
API String ID: 2822291608-2260929820
Opcode ID: 833ddd01eb9948849d16ec647e4cf22caff8f3c98e6a901282b0c27d4440fb5c
Instruction ID: 253e3ead97a11c476210bd50ffcbc06e29f956a0a0049d02da6fa7485fac67c7
Opcode Fuzzy Hash: 833ddd01eb9948849d16ec647e4cf22caff8f3c98e6a901282b0c27d4440fb5c
Instruction Fuzzy Hash: AAC10033B087C282EB60AB16E4407BA67A5FB95B84F454135EE8C5BBA9CF3CE441C701

Function 00007FFE013BFB00 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3 ref: 00007FFE013BFB57
EVP_PKEY_derive_set_peer.LIBCRYPTO-3 ref: 00007FFE013BFB75
EVP_PKEY_is_a.LIBCRYPTO-3 ref: 00007FFE013BFBC4
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFE013BFBEA
ERR_new.LIBCRYPTO-3 ref: 00007FFE013BFBF7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BFC0F
EVP_PKEY_derive.LIBCRYPTO-3 ref: 00007FFE013BFC27
ERR_new.LIBCRYPTO-3 ref: 00007FFE013BFC30
ERR_new.LIBCRYPTO-3 ref: 00007FFE013BFC72
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BFC8A
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFE013BFCB9
EVP_PKEY_CTX_free.LIBCRYPTO-3 ref: 00007FFE013BFCC1
ERR_new.LIBCRYPTO-3 ref: 00007FFE013BFCDF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BFCF7

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFE013BFBDD, 00007FFE013BFC08, 00007FFE013BFC83, 00007FFE013BFCA9, 00007FFE013BFCF0
ssl_derive, xrefs: 00007FFE013BFBFC, 00007FFE013BFC7C, 00007FFE013BFCE4

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_new$R_set_debug$O_clear_freeO_mallocX_freeX_new_from_pkeyY_deriveY_derive_set_peerY_is_a
String ID: ..\s\ssl\s3_lib.c$ssl_derive
API String ID: 885776404-3053632713
Opcode ID: 6738f77343f151bafde0f18fd525ca252385cc30361818a3bc451384b79df2c1
Instruction ID: 4927e84e8c0cd57adcfce0e41c622df83ea6ef91c627e647c6f621c9ddbb5522
Opcode Fuzzy Hash: 6738f77343f151bafde0f18fd525ca252385cc30361818a3bc451384b79df2c1
Instruction Fuzzy Hash: F851C172B0864291FB00EB52A8906FD5755AF94BD4F560032EE4D8FBB6EE2CE5828741

Function 00007FFE013BFDB0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013BFDE7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BFDFF
EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3 ref: 00007FFE013BFE35
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFE013BFE99
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFE013BFEB3
EVP_PKEY_encapsulate.LIBCRYPTO-3 ref: 00007FFE013BFEDD
ERR_new.LIBCRYPTO-3 ref: 00007FFE013BFEE6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BFF78
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFE013BFFA7
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013BFFBC
EVP_PKEY_CTX_free.LIBCRYPTO-3 ref: 00007FFE013BFFC4

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFE013BFDF8, 00007FFE013BFE92, 00007FFE013BFEA3, 00007FFE013BFF4C, 00007FFE013BFF71, 00007FFE013BFF97, 00007FFE013BFFB2
ssl_encapsulate, xrefs: 00007FFE013BFDEC, 00007FFE013BFF40, 00007FFE013BFF6A

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_mallocR_newR_set_debug$O_clear_freeO_freeX_freeX_new_from_pkeyY_encapsulate
String ID: ..\s\ssl\s3_lib.c$ssl_encapsulate
API String ID: 1298386825-1554727935
Opcode ID: a99f24dbd49a9be480758e8003e43373478e223309b7d6ee1fd0b69586a73a0f
Instruction ID: db94bcd2bc5722d4689ff8dc09f5b530089efc54e879e821509f191e86ca7449
Opcode Fuzzy Hash: a99f24dbd49a9be480758e8003e43373478e223309b7d6ee1fd0b69586a73a0f
Instruction Fuzzy Hash: 1A51B131A19A4291F710EB26E8905BD6355BF95BC0F524032EE4D4FBB5EE3CD246C741

Function 00007FFE013B1EE2 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFE013C5917
ERR_new.LIBCRYPTO-3 ref: 00007FFE013C5924
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013C593C
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013C594D
OPENSSL_sk_find.LIBCRYPTO-3 ref: 00007FFE013C5981
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C599A
ERR_new.LIBCRYPTO-3 ref: 00007FFE013C599F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013C59B7
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFE013C59D2
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C59FD
ERR_new.LIBCRYPTO-3 ref: 00007FFE013C5A02
ERR_new.LIBCRYPTO-3 ref: 00007FFE013C5A18
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013C5A30
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013C5A41

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FFE013C590B, 00007FFE013C5935, 00007FFE013C5990, 00007FFE013C59B0, 00007FFE013C59F3, 00007FFE013C5A29
SSL_COMP_add_compression_method, xrefs: 00007FFE013C5929, 00007FFE013C59A4, 00007FFE013C5A07, 00007FFE013C5A1D

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_new$R_set_debug$O_freeR_set_error$L_sk_findL_sk_pushO_malloc
String ID: ..\s\ssl\ssl_ciph.c$SSL_COMP_add_compression_method
API String ID: 672050802-2070406874
Opcode ID: 5eb6083eff30213e309ffbb13df3eef97f27c06261f3aa2026811ff320cc80a2
Instruction ID: 675f15ca23c801a3ae9e0041a661e796765c5d5ace66450f9a32013f7a6d130f
Opcode Fuzzy Hash: 5eb6083eff30213e309ffbb13df3eef97f27c06261f3aa2026811ff320cc80a2
Instruction Fuzzy Hash: F3418A64F2C64282F794ABA1E8816FD2251AF95790FC54031E90D4FAF6EF2CF9828701

Function 00007FFE013DDDC0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE013B1087: ERR_new.LIBCRYPTO-3 ref: 00007FFE013CBC3F
Part of subcall function 00007FFE013B1087: ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013CBC57
Part of subcall function 00007FFE013B1087: ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013CBC68

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFE013DDDFB
ERR_new.LIBCRYPTO-3 ref: 00007FFE013DDE08
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013DDE20
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013DDE30

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFE013DDDEF, 00007FFE013DDE19, 00007FFE013DDECE, 00007FFE013DDF1D
SSL_SESSION_new, xrefs: 00007FFE013DDE0D, 00007FFE013DDEC2

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_zalloc
String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new
API String ID: 1179349375-402823876
Opcode ID: 3e6586d1590c5e37fe5a7cb55c6f6f0f2fce94f93ce1c7229bf9571863312e5a
Instruction ID: d698f8d44514de9271e3b77758674a0d0499aa9f0c7a685bc1a4ccefa1c25235
Opcode Fuzzy Hash: 3e6586d1590c5e37fe5a7cb55c6f6f0f2fce94f93ce1c7229bf9571863312e5a
Instruction Fuzzy Hash: 1B41A235A19A8282E744AB61D8917FD2291FF94B84F844036D98D4F7F6EF3CD1458711

Function 00007FFE013B11E0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFE013C3E23
X509_free.LIBCRYPTO-3 ref: 00007FFE013C3E37
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFE013C3E44
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFE013C3E57
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C3E70
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C3E9B
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C3EB4
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C3ECD
X509_STORE_free.LIBCRYPTO-3 ref: 00007FFE013C3ED9
X509_STORE_free.LIBCRYPTO-3 ref: 00007FFE013C3EE5
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C3F0A
CRYPTO_THREAD_lock_free.LIBCRYPTO-3 ref: 00007FFE013C3F16
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C3F2B

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFE013C3E60, 00007FFE013C3E8E, 00007FFE013C3EA7, 00007FFE013C3EC0, 00007FFE013C3EFD, 00007FFE013C3F21

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_free$E_freeX509_Y_free$D_lock_freeL_sk_pop_freeX509_free
String ID: ..\s\ssl\ssl_cert.c
API String ID: 3478116879-349359282
Opcode ID: 0b9053203604b4df65f440c8bc2aa01b9e902017c6c466a04def92ae8f2e1a5e
Instruction ID: f280972606d57bbc57826e52e0bda65dd8c69dd5156c4119d38714ceac5d818c
Opcode Fuzzy Hash: 0b9053203604b4df65f440c8bc2aa01b9e902017c6c466a04def92ae8f2e1a5e
Instruction Fuzzy Hash: 03317C32B18B4291EB44AB35E4907BC6320FB81B84F844132EE5D4F6B6DF6DE592C341

Function 00007FFE013D5DE0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFE013D5E1E
CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFE013D5E37
OBJ_nid2sn.LIBCRYPTO-3 ref: 00007FFE013D5E69
EVP_get_digestbyname.LIBCRYPTO-3 ref: 00007FFE013D5E71

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013D5E0E, 00007FFE013D5E29, 00007FFE013D5ECC, 00007FFE013D5EE1, 00007FFE013D5F01
dane_ctx_enable, xrefs: 00007FFE013D5EF5

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_zalloc$J_nid2snP_get_digestbyname
String ID: ..\s\ssl\ssl_lib.c$dane_ctx_enable
API String ID: 4284552970-1287278166
Opcode ID: a8f4df135f03f3dc9719767073f17fcf7d8dbe2755162a583af999141d426ab7
Instruction ID: f7d34ecd394738373b558a31767cb752726bb3ae418c90ebdef635fc04b83894
Opcode Fuzzy Hash: a8f4df135f03f3dc9719767073f17fcf7d8dbe2755162a583af999141d426ab7
Instruction Fuzzy Hash: 2B31D031B19A9196E754AB25F4803BD3771FB44B80F844135EA8D0BBB6EF2DE592C700

Function 00007FFE013B157D Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F1E23
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F1E3C
BN_free.LIBCRYPTO-3 ref: 00007FFE013F1E48
BN_free.LIBCRYPTO-3 ref: 00007FFE013F1E54
BN_free.LIBCRYPTO-3 ref: 00007FFE013F1E60
BN_free.LIBCRYPTO-3 ref: 00007FFE013F1E6C
BN_free.LIBCRYPTO-3 ref: 00007FFE013F1E78
BN_free.LIBCRYPTO-3 ref: 00007FFE013F1E84
BN_free.LIBCRYPTO-3 ref: 00007FFE013F1E90
BN_free.LIBCRYPTO-3 ref: 00007FFE013F1E9C

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFE013F1E16, 00007FFE013F1E2F

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: N_free$O_free
String ID: ..\s\ssl\tls_srp.c
API String ID: 3506937590-1778748169
Opcode ID: 9d7af7435e934e5ed9e01f91a7a4af21c5cc41de842634f5dae193d241a08895
Instruction ID: 92e9b6bb3fd21327d01aa64de7ec3270d6211976651847253c91d2cba80f197b
Opcode Fuzzy Hash: 9d7af7435e934e5ed9e01f91a7a4af21c5cc41de842634f5dae193d241a08895
Instruction Fuzzy Hash: 2521D852E18A8282E746EB71C8517FC2324EBA4B4CF495235FE0C4E27ADF6DA6D18351

Function 00007FFE013F3C30 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F3C85
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F3C9B
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFE013F3CEB
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F3D00
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F3D16
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFE013F3D6B
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F3D80
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F3D96

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFE013F3C74, 00007FFE013F3C8E, 00007FFE013F3CF3, 00007FFE013F3D09, 00007FFE013F3D73, 00007FFE013F3D89

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_free$L_cleanse
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 927910673-1306860146
Opcode ID: c22c73bbe0c40602e1db3ae9ade029143c7cb0ba8300de2ccb5f558f84c041da
Instruction ID: 87a1557a7ea7c746a5d987ac7daff63167b77d917d4cc9b2e4bc8889a9628482
Opcode Fuzzy Hash: c22c73bbe0c40602e1db3ae9ade029143c7cb0ba8300de2ccb5f558f84c041da
Instruction Fuzzy Hash: B3513C22A19B8281EB14EF26D49027C2761FF89BC8F455135DE0D5BBB6EF2DE492C340

Function 00007FFE013B2536 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE0140BD70
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFE0140BD97
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140BDC4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140BDDC
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140BDEE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140BE06

Strings

tls_parse_ctos_ec_pt_formats, xrefs: 00007FFE0140BDC9, 00007FFE0140BDF3
D:\a\1\s\include\internal/packet.h, xrefs: 00007FFE0140BD63, 00007FFE0140BD77
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFE0140BDD5, 00007FFE0140BDFF

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_memdup
String ID: ..\s\ssl\statem\extensions_srvr.c$D:\a\1\s\include\internal/packet.h$tls_parse_ctos_ec_pt_formats
API String ID: 3243760035-2708166893
Opcode ID: 9eee9a388c2e65b901abe693a96c46c622091c7007ef978c19ca4e338151e95f
Instruction ID: 5cabd9f115ff24f73e4403b79e03702be58e67978d301b3afe66693a6a035b97
Opcode Fuzzy Hash: 9eee9a388c2e65b901abe693a96c46c622091c7007ef978c19ca4e338151e95f
Instruction Fuzzy Hash: 8A31F225B09B8292E7509B61E8406EDA360FF59784F444135EA8C4BBB6DF3CEA92C305

Function 00007FFE013B25EF Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFE01403E81
ERR_new.LIBCRYPTO-3 ref: 00007FFE01403E9F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01403EB7
memmove.VCRUNTIME140 ref: 00007FFE01403EE6
ERR_new.LIBCRYPTO-3 ref: 00007FFE01403F4C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01403F64

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFE01403E72, 00007FFE01403EB0, 00007FFE01403F5D
tls_construct_ctos_session_ticket, xrefs: 00007FFE01403EA4, 00007FFE01403F51

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug$O_mallocmemmove
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_session_ticket
API String ID: 3517136906-3277354937
Opcode ID: 9946e5549853d265629e70989b3bdb6f21cff74586ee542c8bbe3980c8a5dca3
Instruction ID: 506b02faf9df1d4bad0d6628bc5b4cb448154088febd781c8e24be7ef8fb9ca8
Opcode Fuzzy Hash: 9946e5549853d265629e70989b3bdb6f21cff74586ee542c8bbe3980c8a5dca3
Instruction Fuzzy Hash: CA418031B1964295EB659B52D4903B82BA0FB84F90F58403AEA0D4BBF5DF7CED91C341

Function 00007FFE013B1087 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013CBC3F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013CBC57
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013CBC68
CRYPTO_THREAD_run_once.LIBCRYPTO-3 ref: 00007FFE013CBCA7
CRYPTO_THREAD_run_once.LIBCRYPTO-3 ref: 00007FFE013CBCD2
CRYPTO_THREAD_run_once.LIBCRYPTO-3 ref: 00007FFE013CBCFB

Strings

..\s\ssl\ssl_init.c, xrefs: 00007FFE013CBC50
OPENSSL_init_ssl, xrefs: 00007FFE013CBC44

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: D_run_once$R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_init.c$OPENSSL_init_ssl
API String ID: 3879570137-3839768916
Opcode ID: 19e1efd9c36bb943d9c337dfea2bbc448af7aa4a23321f0bd318c7765c22e0d6
Instruction ID: eab0229a7b5e9046f7286d34514187980d15aa4ec87c8eb480c0c01e06cd1e18
Opcode Fuzzy Hash: 19e1efd9c36bb943d9c337dfea2bbc448af7aa4a23321f0bd318c7765c22e0d6
Instruction Fuzzy Hash: CA317E75F0810387FB449B15E8926B962A5AF907C8F895035E90E8E5FADE2CED818742

Function 00007FFDFAAF18A0 Relevance: 13.9, APIs: 9, Instructions: 426COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312 ref: 00007FFDFAAF1903
PyType_IsSubtype.PYTHON312 ref: 00007FFDFAAF19F6
PyType_IsSubtype.PYTHON312 ref: 00007FFDFAAF1A53
PyUnicode_FromKindAndData.PYTHON312 ref: 00007FFDFAAF1B24
PyMem_Free.PYTHON312 ref: 00007FFDFAAF1B32
PyMem_Realloc.PYTHON312 ref: 00007FFDFAAF1C1B
PyMem_Free.PYTHON312 ref: 00007FFDFAAF3A2D
PyErr_NoMemory.PYTHON312 ref: 00007FFDFAAF3A33

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Mem_$FreeSubtypeType_$DataErr_FromKindMallocMemoryReallocUnicode_
String ID:
API String ID: 3719493655-0
Opcode ID: 13b0b1041cca574ca06701db0d45e779ed743a60764eb712a04665505c58f9af
Instruction ID: ca7f938f6a81cfafb8d04ff9bea617675d8ff473e01879fef36b3b06f0a8e186
Opcode Fuzzy Hash: 13b0b1041cca574ca06701db0d45e779ed743a60764eb712a04665505c58f9af
Instruction Fuzzy Hash: 5D02F272B08BC282E76D9B15D464A7977A1EF44780F5441B2DABE467C8EF3DE44AC310

Function 00007FFDFF3F1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFF3F197C
memset.VCRUNTIME140 ref: 00007FFDFF3F19A0
RtlCaptureContext.KERNEL32 ref: 00007FFDFF3F19A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFF3F19C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFF3F1A04
memset.VCRUNTIME140 ref: 00007FFDFF3F1A37
IsDebuggerPresent.KERNEL32 ref: 00007FFDFF3F1A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF3F1A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF3F1A84

Memory Dump Source

Source File: 00000001.00000002.1789715337.00007FFDFF3F1000.00000020.00000001.01000000.0000003C.sdmp, Offset: 00007FFDFF3F0000, based on PE: true

Associated: 00000001.00000002.1789684258.00007FFDFF3F0000.00000002.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789751805.00007FFDFF3F3000.00000002.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789778567.00007FFDFF3F4000.00000004.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789802581.00007FFDFF3F5000.00000002.00000001.01000000.0000003C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff3f0000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction ID: 7753344d4c65d2e257c325966740e7f5bfcf14630f5ea11364f7cbd9fdb8a396
Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction Fuzzy Hash: EC316172708BC286EB64AF60E850BED73A0FB44744F44413ADA6E5B6D8DF38D548C704

Function 00007FFDFF6D1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFF6D197C
memset.VCRUNTIME140 ref: 00007FFDFF6D19A0
RtlCaptureContext.KERNEL32 ref: 00007FFDFF6D19A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFF6D19C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFF6D1A04
memset.VCRUNTIME140 ref: 00007FFDFF6D1A37
IsDebuggerPresent.KERNEL32 ref: 00007FFDFF6D1A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF6D1A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF6D1A84

Memory Dump Source

Source File: 00000001.00000002.1790153239.00007FFDFF6D1000.00000020.00000001.01000000.00000038.sdmp, Offset: 00007FFDFF6D0000, based on PE: true

Associated: 00000001.00000002.1790132929.00007FFDFF6D0000.00000002.00000001.01000000.00000038.sdmpDownload File
Associated: 00000001.00000002.1790172913.00007FFDFF6D3000.00000002.00000001.01000000.00000038.sdmpDownload File
Associated: 00000001.00000002.1790196351.00007FFDFF6D5000.00000002.00000001.01000000.00000038.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff6d0000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction ID: 9666b5f9b5cc1f7efc83bcdb49c5daa64624893103b130f39460f60c5af01df8
Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction Fuzzy Hash: 90314F72708B8289EB608F61E8607ED7368FB84748F44413ADA6D57A99DF78D648C710

Function 00007FFDFF6A1A80 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFF6A1A9C
memset.VCRUNTIME140 ref: 00007FFDFF6A1AC0
RtlCaptureContext.KERNEL32 ref: 00007FFDFF6A1AC9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFF6A1AE3
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFF6A1B24
memset.VCRUNTIME140 ref: 00007FFDFF6A1B57
IsDebuggerPresent.KERNEL32 ref: 00007FFDFF6A1B78
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF6A1B99
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF6A1BA4

Memory Dump Source

Source File: 00000001.00000002.1789939538.00007FFDFF6A1000.00000020.00000001.01000000.0000003A.sdmp, Offset: 00007FFDFF6A0000, based on PE: true

Associated: 00000001.00000002.1789917112.00007FFDFF6A0000.00000002.00000001.01000000.0000003A.sdmpDownload File
Associated: 00000001.00000002.1789963055.00007FFDFF6A5000.00000002.00000001.01000000.0000003A.sdmpDownload File
Associated: 00000001.00000002.1789984878.00007FFDFF6AF000.00000004.00000001.01000000.0000003A.sdmpDownload File
Associated: 00000001.00000002.1790005078.00007FFDFF6B0000.00000002.00000001.01000000.0000003A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff6a0000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 4daa35a496de95c00f3549ff2ee86a4c9bdd8fe61db81f85dce5350646ac50d2
Instruction ID: a773ed1d172f943f45ff5ee8832b1ee53c677bc84d1298b74def18fcf6297097
Opcode Fuzzy Hash: 4daa35a496de95c00f3549ff2ee86a4c9bdd8fe61db81f85dce5350646ac50d2
Instruction Fuzzy Hash: 0D314F73709A8185EB60CF60E8607ED7364FB85744F44413ADA6D4BAD8EF38D658CB10

Function 00007FFDFAAF3068 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFAAF3084
memset.VCRUNTIME140 ref: 00007FFDFAAF30A8
RtlCaptureContext.KERNEL32 ref: 00007FFDFAAF30B1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFAAF30CB
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFAAF310C
memset.VCRUNTIME140 ref: 00007FFDFAAF313F
IsDebuggerPresent.KERNEL32 ref: 00007FFDFAAF3160
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAAF3181
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFAAF318C

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 14da1239b2aff37f2225a2b2eb9612ff8327347efab586c9ed8106aec9f5eecf
Instruction ID: ee2e9123d071938bb736f3c2a7e97d30ed7683e48deb00d14748d544c7283dd7
Opcode Fuzzy Hash: 14da1239b2aff37f2225a2b2eb9612ff8327347efab586c9ed8106aec9f5eecf
Instruction Fuzzy Hash: 22316D72709BC289EBA88F60E860BED3364FB84744F44403ADA5E47A98DF38C54DC714

Function 00007FFDFF6C1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFF6C197C
memset.VCRUNTIME140 ref: 00007FFDFF6C19A0
RtlCaptureContext.KERNEL32 ref: 00007FFDFF6C19A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFF6C19C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFF6C1A04
memset.VCRUNTIME140 ref: 00007FFDFF6C1A37
IsDebuggerPresent.KERNEL32 ref: 00007FFDFF6C1A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF6C1A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF6C1A84

Memory Dump Source

Source File: 00000001.00000002.1790050435.00007FFDFF6C1000.00000020.00000001.01000000.00000039.sdmp, Offset: 00007FFDFF6C0000, based on PE: true

Associated: 00000001.00000002.1790028351.00007FFDFF6C0000.00000002.00000001.01000000.00000039.sdmpDownload File
Associated: 00000001.00000002.1790073229.00007FFDFF6C4000.00000002.00000001.01000000.00000039.sdmpDownload File
Associated: 00000001.00000002.1790092982.00007FFDFF6C5000.00000004.00000001.01000000.00000039.sdmpDownload File
Associated: 00000001.00000002.1790113402.00007FFDFF6C6000.00000002.00000001.01000000.00000039.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff6c0000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 0a57d354b9f48531f5e4b6dcb676abd35c4c55538187d76e763eeca891f7d0db
Instruction ID: aaffd05204991c931c586ca21db32dbf8cbfb9e3cbb1f987b55bf93efd043cd1
Opcode Fuzzy Hash: 0a57d354b9f48531f5e4b6dcb676abd35c4c55538187d76e763eeca891f7d0db
Instruction Fuzzy Hash: 61313072708B8185EB60AF60E8A07E97365FB44749F44413ADAAD47B99DF38D648C710

Function 00007FFDFF691960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDFF69197C
memset.VCRUNTIME140 ref: 00007FFDFF6919A0
RtlCaptureContext.KERNEL32 ref: 00007FFDFF6919A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDFF6919C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFF691A04
memset.VCRUNTIME140 ref: 00007FFDFF691A37
IsDebuggerPresent.KERNEL32 ref: 00007FFDFF691A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF691A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFF691A84

Memory Dump Source

Source File: 00000001.00000002.1789848549.00007FFDFF691000.00000020.00000001.01000000.0000003B.sdmp, Offset: 00007FFDFF690000, based on PE: true

Associated: 00000001.00000002.1789825319.00007FFDFF690000.00000002.00000001.01000000.0000003B.sdmpDownload File
Associated: 00000001.00000002.1789873449.00007FFDFF696000.00000002.00000001.01000000.0000003B.sdmpDownload File
Associated: 00000001.00000002.1789896284.00007FFDFF69B000.00000002.00000001.01000000.0000003B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff690000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 26897df24f70a55c30b919b36952ff972a20fdcb0ee0bee13c52e1828fe953fd
Instruction ID: f553a3a5198c3b4b1e6003a275c7f4219fed6fe40b53c1bddeedf95d537b2bac
Opcode Fuzzy Hash: 26897df24f70a55c30b919b36952ff972a20fdcb0ee0bee13c52e1828fe953fd
Instruction Fuzzy Hash: 24314172709B8185EB708F60E8A07ED7364FB44748F54413ADA6E47699DF39D648C710

Function 00007FFDFAC89A70 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 398COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAC8A018

Strings

unopened, xrefs: 00007FFDFAC89ABD
NULL, xrefs: 00007FFDFAC89A9D
API call with %s database connection pointer, xrefs: 00007FFDFAC89AC4
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFDFAC89AD5
invalid, xrefs: 00007FFDFAC89AB2
misuse, xrefs: 00007FFDFAC89AE2
%s at line %d of [%.10s], xrefs: 00007FFDFAC89AEE

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 3510742995-863375387
Opcode ID: ebcfd4d320c8a855c25bad2e79043b46f1baa289721c4d7e74e567b371a0d908
Instruction ID: 12ab006d96f5a402e71427585b2002eefca30880f6c8fbb48294f1e1cff2a08e
Opcode Fuzzy Hash: ebcfd4d320c8a855c25bad2e79043b46f1baa289721c4d7e74e567b371a0d908
Instruction Fuzzy Hash: CC02AF2DB09A8285EB689F119460BBE67A0FF84B85F5481B1DE6E0B7DDDF3DE4458300

Function 00007FFE013C7CB0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3(?,00000000,?,00007FFE013C7A5B), ref: 00007FFE013C7D17
ERR_new.LIBCRYPTO-3(?,00000000,?,00007FFE013C7A5B), ref: 00007FFE013C7D24
ERR_set_debug.LIBCRYPTO-3(?,00000000,?,00007FFE013C7A5B), ref: 00007FFE013C7D3C
ERR_set_error.LIBCRYPTO-3(?,00000000,?,00007FFE013C7A5B), ref: 00007FFE013C7D4C
CRYPTO_free.LIBCRYPTO-3(?,00000000,?,00007FFE013C7A5B), ref: 00007FFE013C7E27

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FFE013C7D02, 00007FFE013C7D35, 00007FFE013C7E1D
ssl_cipher_strength_sort, xrefs: 00007FFE013C7D29

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_freeO_zallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_ciph.c$ssl_cipher_strength_sort
API String ID: 2487674020-1223572542
Opcode ID: 7ec13297eba58d5c0c4d2c0c821356037c72251a1eef246ca4f6df6445aa1417
Instruction ID: 3359645cb092cb6db8e9ae823f2c2369768736031c6995548675b852f9c1681d
Opcode Fuzzy Hash: 7ec13297eba58d5c0c4d2c0c821356037c72251a1eef246ca4f6df6445aa1417
Instruction Fuzzy Hash: D741BE72A04B4286EB55DF51D4845B837A1FB54BC0F968432DE0C4B765EF3DE991CB40

Function 00007FFE01407DE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFE01407E26
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFE01407E96
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFE01407EB6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE01407F1A
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE01407F30
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE01407F59

Strings

..\s\ssl\statem\extensions_cust.c, xrefs: 00007FFE01407E15, 00007FFE01407E84, 00007FFE01407E9F, 00007FFE01407F0D, 00007FFE01407F23, 00007FFE01407F4C

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\statem\extensions_cust.c
API String ID: 3962629258-3973221358
Opcode ID: 2f3a1c2bb5138dd59f392b0823c50638056d8aa9e5e4dd5ac5e039ada175a209
Instruction ID: 9e5e3644efb2554cbe54434f77dcf33747339c044035195ee0b812514c7c535a
Opcode Fuzzy Hash: 2f3a1c2bb5138dd59f392b0823c50638056d8aa9e5e4dd5ac5e039ada175a209
Instruction Fuzzy Hash: 8B419172A06A5281EB52DB92F4805A973A4FB54BC5F45503ADE8C4BBB4EF7CE981C301

Function 00007FFE013B1B31 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE0140E02B
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140E05D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140E075
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140E0A3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140E0BB

Strings

tls_parse_ctos_supported_groups, xrefs: 00007FFE0140E062, 00007FFE0140E0A8
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFE0140E019, 00007FFE0140E06E, 00007FFE0140E0B4

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug$O_free
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_supported_groups
API String ID: 1233037391-3902054871
Opcode ID: 4df750ec9348fb1cd0c9fa7fe0a6d7e6351629e4db1cf5ebe21d21f74df71a32
Instruction ID: 1e02b919ac92b7b3421aed594d9d7e65e14159df8caa5357a69fb6cf49350405
Opcode Fuzzy Hash: 4df750ec9348fb1cd0c9fa7fe0a6d7e6351629e4db1cf5ebe21d21f74df71a32
Instruction Fuzzy Hash: 7A412272B2969292E7618B61E4407BD6390FB95384F444135EB8C5BAB1DF3CE6A1C700

Function 00007FF77C6383B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF77C638B09,00007FF77C633FA5), ref: 00007FF77C63841B
RemoveDirectoryW.KERNEL32(?,00007FF77C638B09,00007FF77C633FA5), ref: 00007FF77C63849E
DeleteFileW.KERNEL32(?,00007FF77C638B09,00007FF77C633FA5), ref: 00007FF77C6384BD
FindNextFileW.KERNEL32(?,00007FF77C638B09,00007FF77C633FA5), ref: 00007FF77C6384CB
FindClose.KERNEL32(?,00007FF77C638B09,00007FF77C633FA5), ref: 00007FF77C6384DC
RemoveDirectoryW.KERNEL32(?,00007FF77C638B09,00007FF77C633FA5), ref: 00007FF77C6384E5

Strings

%s\*, xrefs: 00007FF77C6383E2

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: 3c5da9064b05a0eb78b995f2950a23fea1c5633528eee9ef15dba30a203920cc
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: BB415423A3C54295EB71AB14A4C45FBA362FF9CB54FD00232DA9DC2A95DF3CD5498710

Function 00007FFDFAAF12F0 Relevance: 10.8, APIs: 7, Instructions: 347COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAAF18A0: PyMem_Malloc.PYTHON312 ref: 00007FFDFAAF1903
Part of subcall function 00007FFDFAAF18A0: PyType_IsSubtype.PYTHON312 ref: 00007FFDFAAF19F6
Part of subcall function 00007FFDFAAF18A0: PyType_IsSubtype.PYTHON312 ref: 00007FFDFAAF1A53

PyMem_Malloc.PYTHON312 ref: 00007FFDFAAF1377
PyMem_Free.PYTHON312 ref: 00007FFDFAAF1487
PyErr_NoMemory.PYTHON312 ref: 00007FFDFAAF38AD
_Py_Dealloc.PYTHON312 ref: 00007FFDFAAF38C4

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
String ID:
API String ID: 4139299733-0
Opcode ID: 4c1ab3a9ee10578f50e5ddcb80cbb1500edbf8f85856d8ea69ee8be7dac4cd66
Instruction ID: 652c653133a425ac4284028eba64a46e1dec6fad655e38dc1e937b251321eeaa
Opcode Fuzzy Hash: 4c1ab3a9ee10578f50e5ddcb80cbb1500edbf8f85856d8ea69ee8be7dac4cd66
Instruction Fuzzy Hash: 40E1FCB6B08BE281EB2D8B11D424A7977A5FB40794F1401B5DB7E866C8DF2DE84BC700

Function 00007FF77C63D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF77C63D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF77C63D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF77C63D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF77C63D240
IsDebuggerPresent.KERNEL32 ref: 00007FF77C63D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF77C63D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF77C63D2BC

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: 9d56d606f5c3b37c063e9bc6f7c515f73ed0b3cb21dc667cbd5a27686f391b1e
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 4A313F73728A8186EB619F60E8807FE6361FB88704F544039DB4D87B99DF38D548C724

Function 00007FF77C655C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF77C655CB5

Part of subcall function 00007FF77C655608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C65561C

Part of subcall function 00007FF77C64A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9CE
Part of subcall function 00007FF77C64A9B8: GetLastError.KERNEL32(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9D8

Part of subcall function 00007FF77C64A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF77C64A94F,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64A979
Part of subcall function 00007FF77C64A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF77C64A94F,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64A99E

_get_daylight.LIBCMT ref: 00007FF77C655CA4

Part of subcall function 00007FF77C655668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C65567C

_get_daylight.LIBCMT ref: 00007FF77C655F1A
_get_daylight.LIBCMT ref: 00007FF77C655F2B
_get_daylight.LIBCMT ref: 00007FF77C655F3C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF77C65617C), ref: 00007FF77C655F63

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
Instruction ID: a41159ca12899c9e77a6399d74472c0b955da2c82e3cac3455962cff85b38fbf
Opcode Fuzzy Hash: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
Instruction Fuzzy Hash: A0D1B223B3864245E722BF21E4C55BAA752EF4C794FE08136EB4DC769ADE3CE4418760

Function 00007FF77C64A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF77C64A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF77C64A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF77C64A750
IsDebuggerPresent.KERNEL32 ref: 00007FF77C64A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF77C64A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF77C64A79E

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: 10961d40ca19563583e6b43eebefc639103177f96609aa5d8f11ceec8a24b810
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: 8E317137628B8186DB219F24E8802AFB3A1FB88754F940135EB8D87B59DF3CC1558B10

Function 00007FFE013B108C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE01401EBB

Strings

tls_construct_ctos_cookie, xrefs: 00007FFE01401E7A
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFE01401E86, 00007FFE01401EAE

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_cookie
API String ID: 2581946324-1257894829
Opcode ID: 259aba66962e9b631cacb3e84773a4eee8d71dfe46cb4b12438401466ab06348
Instruction ID: deb58a0e56384905bb946d45ab7e4db9455c23a9b6e1bf67a4d52d191a8cdd58
Opcode Fuzzy Hash: 259aba66962e9b631cacb3e84773a4eee8d71dfe46cb4b12438401466ab06348
Instruction Fuzzy Hash: 18218E21B1864281F750AB62E5917BD2251EF84BD4F580035EE0D4FBB6EF6CE982C380

Function 00007FF77C6518E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C651930
FindFirstFileExW.KERNEL32 ref: 00007FF77C651A3A

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
Instruction ID: 1af0f1ce52f67dc771e30ee579fc503d775ed074317064283adea7303a5f4715
Opcode Fuzzy Hash: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
Instruction Fuzzy Hash: 31B1B7A7B3869241EB62AB21A4801BBE352EB4CBD4FA44131DF5D97B95EE3CE541C310

Function 00007FFE013C9D50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013C9DFC
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFE013C9E11

Strings

gfffffff, xrefs: 00007FFE013C9DCD
..\s\ssl\ssl_conf.c, xrefs: 00007FFE013C9DF5, 00007FFE013C9E07

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_freeO_strdup
String ID: ..\s\ssl\ssl_conf.c$gfffffff
API String ID: 2148955802-4123734156
Opcode ID: 36565d17ced01440f01c1a12bdb88cc94fa3be2b622d0976af61771156605f6e
Instruction ID: 4decbd89397e90a2e6e2afb7c6bda896f9391df0ecb3005c8ffee24bfed66b17
Opcode Fuzzy Hash: 36565d17ced01440f01c1a12bdb88cc94fa3be2b622d0976af61771156605f6e
Instruction Fuzzy Hash: AE217F72B19B4685EF44DF26F48036967A1EB88FC4F1A4035DE4D8F7A9DE2CE4018781

Function 00007FFDFAC362C0 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAC36452
memset.VCRUNTIME140 ref: 00007FFDFAC36463
memcpy.VCRUNTIME140 ref: 00007FFDFAC364D8
memcpy.VCRUNTIME140 ref: 00007FFDFAC364F0
memset.VCRUNTIME140 ref: 00007FFDFAC364FF

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 304fba770c544ede7452a4061ca79efafbc2549250430ea71847b1f8e5c244b1
Instruction ID: a4ebba8c153a59b1c4e83cc98913a5aa41591ecd55ec92e34a765161e12b66d0
Opcode Fuzzy Hash: 304fba770c544ede7452a4061ca79efafbc2549250430ea71847b1f8e5c244b1
Instruction Fuzzy Hash: E8E1E23AB1978186E7988F29D060BBE67A5FB45BC4F044076EE9E437C9DE3DE4858300

Function 00007FF77C655EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF77C655F1A

Part of subcall function 00007FF77C655668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C65567C

_get_daylight.LIBCMT ref: 00007FF77C655F2B

Part of subcall function 00007FF77C655608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C65561C

_get_daylight.LIBCMT ref: 00007FF77C655F3C

Part of subcall function 00007FF77C655638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C65564C

Part of subcall function 00007FF77C64A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9CE
Part of subcall function 00007FF77C64A9B8: GetLastError.KERNEL32(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF77C65617C), ref: 00007FF77C655F63

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction ID: fc3b9eb9033d41aaf311671fe72dcb4598f5c85cbe5fa44e01d0c07e918b8a77
Opcode Fuzzy Hash: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction Fuzzy Hash: 80514D33B3864286E721FF21A9C15AAA762AB4C784F904536EB4DC7696DF3CE4408760

Function 00007FFDFF6C2EB0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 283COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF6C2F23

Strings

src/raw_ocb.c, xrefs: 00007FFDFF6C2F15
OCB_ENCRYPT==direction || OCB_DECRYPT==direction, xrefs: 00007FFDFF6C2F1C

Memory Dump Source

Source File: 00000001.00000002.1790050435.00007FFDFF6C1000.00000020.00000001.01000000.00000039.sdmp, Offset: 00007FFDFF6C0000, based on PE: true

Associated: 00000001.00000002.1790028351.00007FFDFF6C0000.00000002.00000001.01000000.00000039.sdmpDownload File
Associated: 00000001.00000002.1790073229.00007FFDFF6C4000.00000002.00000001.01000000.00000039.sdmpDownload File
Associated: 00000001.00000002.1790092982.00007FFDFF6C5000.00000004.00000001.01000000.00000039.sdmpDownload File
Associated: 00000001.00000002.1790113402.00007FFDFF6C6000.00000002.00000001.01000000.00000039.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff6c0000_lz4wnSavmK.jbxd

Similarity

API ID: _wassert
String ID: OCB_ENCRYPT==direction || OCB_DECRYPT==direction$src/raw_ocb.c
API String ID: 3234217646-1106498308
Opcode ID: 96f1c7f081ec5b5f110a8a436ffb5769e61779f6ca8b250aca86d5a0fd4485a4
Instruction ID: f7f81cbea79e5f7c37a376903a0eba2deb0fb173e1b9a7599b3d6df2639ebf43
Opcode Fuzzy Hash: 96f1c7f081ec5b5f110a8a436ffb5769e61779f6ca8b250aca86d5a0fd4485a4
Instruction Fuzzy Hash: 69E13C4210D6E048C7168F7590206FE7FF0DB1FA59F4D81B6EBE94E58BD508C254EB2A

Function 00007FFE013B1D8E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013DDFE5
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFE013DE007

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFE013DDFD1, 00007FFE013DDFFA

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\ssl_sess.c
API String ID: 3962629258-2868363209
Opcode ID: 17fc693176754f1176451082c2c44af7d9a1f946fc87e3602af76f4eeea5d05d
Instruction ID: 321f55451ca4574233c0d563f1edb0218a17dd9395fdf03042bc3742c802aefa
Opcode Fuzzy Hash: 17fc693176754f1176451082c2c44af7d9a1f946fc87e3602af76f4eeea5d05d
Instruction Fuzzy Hash: 73116531B09F9182E7958B52B94026C6694FB48FC4F590035EE4C5FFA9EF2DD6928310

Function 00007FFE0140FCC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE0140FCF7
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFE0140FD20

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FFE0140FCE7, 00007FFE0140FD10

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\a\1\s\include\internal/packet.h
API String ID: 3962629258-2521442236
Opcode ID: bd6c9304aeb4a024b43df89f4a260b6424ef85be4baf9c0a24da548ddf1e0540
Instruction ID: d50a5902ecdf7cfb4a0bf72a744ab1c2e440895674fe0fe6e3320384f04b3778
Opcode Fuzzy Hash: bd6c9304aeb4a024b43df89f4a260b6424ef85be4baf9c0a24da548ddf1e0540
Instruction Fuzzy Hash: 9D014F32716B5281EB509F52F8846597764FB58BC0F488435EF8C4BB65EE3CD5528700

Function 00007FFE013C1AA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3(00000000,00007FFE013C1176), ref: 00007FFE013C1ACE
CRYPTO_strndup.LIBCRYPTO-3(00000000,00007FFE013C1176), ref: 00007FFE013C1AF1

Strings

..\s\ssl\ssl_asn1.c, xrefs: 00007FFE013C1AC1, 00007FFE013C1AE0

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_freeO_strndup
String ID: ..\s\ssl\ssl_asn1.c
API String ID: 2641571835-3659835543
Opcode ID: e774afb10ac652100d47447a76614ce0792835d75f19e29492a5db2d1d73625e
Instruction ID: 9552613b5e60b92cf1d9f5da975c4ee3eaaccc066bd458975eff24a1e6f84e80
Opcode Fuzzy Hash: e774afb10ac652100d47447a76614ce0792835d75f19e29492a5db2d1d73625e
Instruction Fuzzy Hash: 47016D32B19A5281EB409B56F540368A760FB48BC4F499032FE5D57B6AEF2CD5A18700

Function 00007FFE0140FF50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE0140FF79
CRYPTO_strndup.LIBCRYPTO-3 ref: 00007FFE0140FF92

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FFE0140FF6F, 00007FFE0140FF82

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_freeO_strndup
String ID: D:\a\1\s\include\internal/packet.h
API String ID: 2641571835-2521442236
Opcode ID: d077f02f28dc80c173b48ec0dc7e5fadc96060128e03643208d4e1341bb20662
Instruction ID: 181496053edec152c74f7322c7035830cdd0351b4ba871d94e5dd39fbf477db0
Opcode Fuzzy Hash: d077f02f28dc80c173b48ec0dc7e5fadc96060128e03643208d4e1341bb20662
Instruction Fuzzy Hash: 57F03072B09A4281EB04AF66F8955AC6761EB58BC4F848036EE0C8B775DE2CD5558700

Function 00007FFE013D5F90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013D5FB0
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013D5FCD

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013D5FA9, 00007FFE013D5FB9

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2581946324-1080266419
Opcode ID: b17a1dc97bde2825c6a5434256753d7812aa03e6824a2e1b8617030c61b457a7
Instruction ID: d4bebfd47aa7378ad14e2c9399cd483c50b7c3000b5bfee1ae1f706cdd48c504
Opcode Fuzzy Hash: b17a1dc97bde2825c6a5434256753d7812aa03e6824a2e1b8617030c61b457a7
Instruction Fuzzy Hash: C0E0E562A14A42A2EB00AB35D8817A83761FB54B48F848135DA0C4F7B6EE6DD585C761

Function 00007FFE013F58F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFE013F5933

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFE013F5926

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 2581946324-1306860146
Opcode ID: 7b11ee7e488ba75939e8ba733fee79ce52acc191ae8f20a3968226145aa3e58a
Instruction ID: 2cb439f3fa86b11fe1f551f8969d0d57fa1e7d3343a8b6b9fb0aee46172d9d4a
Opcode Fuzzy Hash: 7b11ee7e488ba75939e8ba733fee79ce52acc191ae8f20a3968226145aa3e58a
Instruction Fuzzy Hash: 0CF08211B1954241EF40BB26F4916BD9251EF89BC4F495035EE0D4FBA7EE2CD8918700

Function 00007FFE013B12D0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_run_once.LIBCRYPTO-3 ref: 00007FFE013C5AEB

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: D_run_once
String ID:
API String ID: 1403826838-0
Opcode ID: 77cbd0b0b8ea079f4b3d3e7baca37b16dafba7cf961424cc6eb1f75db741db41
Instruction ID: e68923e31c7f29c9497ed79f1e5070dd0329cec39782b5f3e8c91ac84ac1248a
Opcode Fuzzy Hash: 77cbd0b0b8ea079f4b3d3e7baca37b16dafba7cf961424cc6eb1f75db741db41
Instruction Fuzzy Hash: E2D0C998E0A50782FB007729D8822B42220BF90788FD14032D00D4E6B6ED1CA9568342

Function 00007FF77C635820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C635830
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C635842
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C635879
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C63588B
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6358A4
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6358B6
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6358CF
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6358E1
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6358FD
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C63590F
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C63592B
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C63593D
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C635959
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C63596B
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C635987
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C635999
GetProcAddress.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6359B5
GetLastError.KERNEL32(?,00007FF77C6364BF,?,00007FF77C63336E), ref: 00007FF77C6359C7

Strings

PyObject_CallFunction, xrefs: 00007FF77C635CE7, 00007FF77C635D09
PyConfig_SetString, xrefs: 00007FF77C635A35, 00007FF77C635A57
PyConfig_Read, xrefs: 00007FF77C6359D9, 00007FF77C6359FB
PyObject_CallFunctionObjArgs, xrefs: 00007FF77C635D15, 00007FF77C635D37
PyConfig_Clear, xrefs: 00007FF77C63597D, 00007FF77C63599F
PyEval_EvalCode, xrefs: 00007FF77C635BA5, 00007FF77C635BC7
PyStatus_Exception, xrefs: 00007FF77C635E29, 00007FF77C635E4B
PyMem_RawFree, xrefs: 00007FF77C635C8B, 00007FF77C635CAD
PyUnicode_FromFormat, xrefs: 00007FF77C635F3D, 00007FF77C635F5F
PyConfig_InitIsolatedConfig, xrefs: 00007FF77C6359AB, 00007FF77C6359CD
PyErr_Restore, xrefs: 00007FF77C635B77, 00007FF77C635B99
PyObject_Str, xrefs: 00007FF77C635D9F, 00007FF77C635DC1
PyUnicode_AsUTF8, xrefs: 00007FF77C635EB3, 00007FF77C635ED5
PyModule_GetDict, xrefs: 00007FF77C635CB9, 00007FF77C635CDB
PyUnicode_Join, xrefs: 00007FF77C635F99, 00007FF77C635FBB
PyMarshal_ReadObjectFromString, xrefs: 00007FF77C635C5D, 00007FF77C635C7F
Failed to get address for %hs, xrefs: 00007FF77C635851
PyUnicode_Decode, xrefs: 00007FF77C635EE1, 00007FF77C635F03
PyUnicode_DecodeFSDefault, xrefs: 00007FF77C635F0F, 00007FF77C635F31
Py_Finalize, xrefs: 00007FF77C6358C5, 00007FF77C6358E7
PyUnicode_FromString, xrefs: 00007FF77C635F6B, 00007FF77C635F8D
PyErr_NormalizeException, xrefs: 00007FF77C635AED, 00007FF77C635B0F
Py_DecodeLocale, xrefs: 00007FF77C63586F, 00007FF77C635891
PyConfig_SetWideStringList, xrefs: 00007FF77C635A63, 00007FF77C635A85
PyObject_SetAttrString, xrefs: 00007FF77C635D71, 00007FF77C635D93
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF77C635DCD, 00007FF77C635DEF
Py_PreInitialize, xrefs: 00007FF77C63594F, 00007FF77C635971
PyUnicode_Replace, xrefs: 00007FF77C635FC7, 00007FF77C635FE9
PySys_SetObject, xrefs: 00007FF77C635E85, 00007FF77C635EA7
PyImport_AddModule, xrefs: 00007FF77C635BD3, 00007FF77C635BF5
Py_IsInitialized, xrefs: 00007FF77C635921, 00007FF77C635943
PyConfig_SetBytesString, xrefs: 00007FF77C635A07, 00007FF77C635A29
PyImport_ExecCodeModule, xrefs: 00007FF77C635C01, 00007FF77C635C23
PyErr_Occurred, xrefs: 00007FF77C635B1B, 00007FF77C635B3D
Py_DecRef, xrefs: 00007FF77C635826, 00007FF77C635848
PySys_GetObject, xrefs: 00007FF77C635E57, 00007FF77C635E79
PyErr_Fetch, xrefs: 00007FF77C635ABF, 00007FF77C635AE1
Py_InitializeFromConfig, xrefs: 00007FF77C6358F3, 00007FF77C635915
PyErr_Print, xrefs: 00007FF77C635B49, 00007FF77C635B6B
PyErr_Clear, xrefs: 00007FF77C635A91, 00007FF77C635AB3
Py_ExitStatusException, xrefs: 00007FF77C63589A, 00007FF77C6358BC
PyRun_SimpleStringFlags, xrefs: 00007FF77C635DFB, 00007FF77C635E1D
PyObject_GetAttrString, xrefs: 00007FF77C635D43, 00007FF77C635D65
GetProcAddress, xrefs: 00007FF77C635858
PyImport_ImportModule, xrefs: 00007FF77C635C2F, 00007FF77C635C51

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: 0f67f3f9f5ef3faca929c6e198b9d2a730e8d2c9f8a7c052984995e3f0724bfe
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: 5022B566B39F0791FB07BB55B8D01B6A7A7AF4C745FE41436C91E82264EF3CA1488234

Function 00007FF77C6376B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF77C6376C7
GetLastError.KERNEL32 ref: 00007FF77C6376D9
GetProcAddress.KERNEL32 ref: 00007FF77C637715
GetLastError.KERNEL32 ref: 00007FF77C637727
GetProcAddress.KERNEL32 ref: 00007FF77C637740
GetLastError.KERNEL32 ref: 00007FF77C637752
GetProcAddress.KERNEL32 ref: 00007FF77C63776B
GetLastError.KERNEL32 ref: 00007FF77C63777D
GetProcAddress.KERNEL32 ref: 00007FF77C637799
GetLastError.KERNEL32 ref: 00007FF77C6377AB
GetProcAddress.KERNEL32 ref: 00007FF77C6377C7
GetLastError.KERNEL32 ref: 00007FF77C6377D9
GetProcAddress.KERNEL32 ref: 00007FF77C6377F5
GetLastError.KERNEL32 ref: 00007FF77C637807
GetProcAddress.KERNEL32 ref: 00007FF77C637823
GetLastError.KERNEL32 ref: 00007FF77C637835
GetProcAddress.KERNEL32 ref: 00007FF77C637851
GetLastError.KERNEL32 ref: 00007FF77C637863

Strings

Tcl_MutexFinalize, xrefs: 00007FF77C6378FF, 00007FF77C637921
Tcl_CreateThread, xrefs: 00007FF77C637819, 00007FF77C63783B
Tk_GetNumMainWindows, xrefs: 00007FF77C637C97, 00007FF77C637CB9
Tcl_CreateObjCommand, xrefs: 00007FF77C637A6F, 00007FF77C637A91
Tcl_ThreadAlert, xrefs: 00007FF77C6379E5, 00007FF77C637A07
Tcl_FinalizeThread, xrefs: 00007FF77C6377BD, 00007FF77C6377DF
Failed to get address for %hs, xrefs: 00007FF77C6376E8
Tcl_Finalize, xrefs: 00007FF77C63778F, 00007FF77C6377B1
Tcl_JoinThread, xrefs: 00007FF77C637875, 00007FF77C637897
Tcl_SetVar2Ex, xrefs: 00007FF77C637B27, 00007FF77C637B49
Tcl_NewByteArrayObj, xrefs: 00007FF77C637AF9, 00007FF77C637B1B
Tcl_ConditionFinalize, xrefs: 00007FF77C63792D, 00007FF77C63794F
Tcl_SetVar2, xrefs: 00007FF77C637A41, 00007FF77C637A63
Tcl_GetObjResult, xrefs: 00007FF77C637B55, 00007FF77C637B77
Tcl_Free, xrefs: 00007FF77C637C3B, 00007FF77C637C5D
Tcl_EvalFile, xrefs: 00007FF77C637B83, 00007FF77C637BA5
Tcl_NewStringObj, xrefs: 00007FF77C637ACB, 00007FF77C637AED
Tcl_EvalEx, xrefs: 00007FF77C637BB1, 00007FF77C637BD3
Tcl_Alloc, xrefs: 00007FF77C637C0D, 00007FF77C637C2F
Tcl_CreateInterp, xrefs: 00007FF77C63770B, 00007FF77C63772D
Tcl_ConditionWait, xrefs: 00007FF77C637989, 00007FF77C6379AB
Tcl_DeleteInterp, xrefs: 00007FF77C6377EB, 00007FF77C63780D
Tcl_ConditionNotify, xrefs: 00007FF77C63795B, 00007FF77C63797D
Tcl_GetVar2, xrefs: 00007FF77C637A13, 00007FF77C637A35
Tk_Init, xrefs: 00007FF77C637C69, 00007FF77C637C8B
Tcl_MutexLock, xrefs: 00007FF77C6378A3, 00007FF77C6378C5
Tcl_GetString, xrefs: 00007FF77C637A9D, 00007FF77C637ABF
Tcl_FindExecutable, xrefs: 00007FF77C637736, 00007FF77C637758
Tcl_EvalObjv, xrefs: 00007FF77C637BDF, 00007FF77C637C01
Tcl_Init, xrefs: 00007FF77C6376C0, 00007FF77C6376DF
Tcl_GetCurrentThread, xrefs: 00007FF77C637847, 00007FF77C637869
Tcl_ThreadQueueEvent, xrefs: 00007FF77C6379B7, 00007FF77C6379D9
Tcl_MutexUnlock, xrefs: 00007FF77C6378D1, 00007FF77C6378F3
Tcl_DoOneEvent, xrefs: 00007FF77C637761, 00007FF77C637783
GetProcAddress, xrefs: 00007FF77C6376EF

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: c7cd5e8f845eefd49097c50b4c305f367ae8b8077bee09d16880e4613f3d8226
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 5C02BE62B3DB0790EB17BB55BAD4577A3A3AF4D754BE41031CA2D822A0EF3CB5448235

Function 00007FFE013B22F2 Relevance: 52.7, APIs: 26, Strings: 4, Instructions: 198COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE013BBB59
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFE013BBB71
ERR_new.LIBCRYPTO-3 ref: 00007FFE013BBBF6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BBC04
BIO_free.LIBCRYPTO-3 ref: 00007FFE013BBC27
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFE013BBC3C
EVP_MD_get_type.LIBCRYPTO-3 ref: 00007FFE013BBC44
ERR_new.LIBCRYPTO-3 ref: 00007FFE013BBC4E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BBC66
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFE013BBC86
ERR_new.LIBCRYPTO-3 ref: 00007FFE013BBC93
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BBCAB
EVP_MD_CTX_copy_ex.LIBCRYPTO-3 ref: 00007FFE013BBCD6
ERR_new.LIBCRYPTO-3 ref: 00007FFE013BBCDF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013BBDD1
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFE013BBDF0

Strings

..\s\ssl\s3_enc.c, xrefs: 00007FFE013BBBEC, 00007FFE013BBC5F, 00007FFE013BBCA4, 00007FFE013BBDCA
ssl3-ms, xrefs: 00007FFE013BBD23
ssl3_final_finish_mac, xrefs: 00007FFE013BBC53, 00007FFE013BBC98, 00007FFE013BBDC3
ssl3_digest_cached_records, xrefs: 00007FFE013BBBE5

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug$X_new$D_get_typeO_ctrlO_freeX_copy_exX_freeX_get0_md
String ID: ..\s\ssl\s3_enc.c$ssl3-ms$ssl3_digest_cached_records$ssl3_final_finish_mac
API String ID: 2271831671-3843019499
Opcode ID: 0307566b406547522c9582f5a90dc84eba7554021ef6ae1d28b807c284413efc
Instruction ID: e1591a4b362359a2666e8895d3d9d9f14df375f9eed098a88bb225639bf9fad7
Opcode Fuzzy Hash: 0307566b406547522c9582f5a90dc84eba7554021ef6ae1d28b807c284413efc
Instruction Fuzzy Hash: 1881B221A1C68A91F760EB229891BFE6350BF95784F814435EE4D4F6B6EF3CE186C701

Function 00007FFE013EBB60 Relevance: 45.8, APIs: 16, Strings: 10, Instructions: 294COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FFE013EBC8A
BIO_printf.LIBCRYPTO-3 ref: 00007FFE013EBC9C
BIO_indent.LIBCRYPTO-3 ref: 00007FFE013EBCC1
BIO_printf.LIBCRYPTO-3 ref: 00007FFE013EBCFB
BIO_indent.LIBCRYPTO-3 ref: 00007FFE013EBD92
BIO_printf.LIBCRYPTO-3 ref: 00007FFE013EBDA4
BIO_indent.LIBCRYPTO-3 ref: 00007FFE013EBDDE
BIO_printf.LIBCRYPTO-3 ref: 00007FFE013EBE21
BIO_indent.LIBCRYPTO-3 ref: 00007FFE013EBE6F
BIO_printf.LIBCRYPTO-3 ref: 00007FFE013EBEA2
BIO_indent.LIBCRYPTO-3 ref: 00007FFE013EBEF6
BIO_printf.LIBCRYPTO-3 ref: 00007FFE013EBF08
d2i_X509_NAME.LIBCRYPTO-3 ref: 00007FFE013EBF1C
BIO_puts.LIBCRYPTO-3 ref: 00007FFE013EBF33
BIO_puts.LIBCRYPTO-3 ref: 00007FFE013EBF55
X509_NAME_free.LIBCRYPTO-3 ref: 00007FFE013EBF5D

Part of subcall function 00007FFE013EE210: BIO_printf.LIBCRYPTO-3(?,00007FFE013EB69A), ref: 00007FFE013EE254
Part of subcall function 00007FFE013EE210: BIO_printf.LIBCRYPTO-3(?,00007FFE013EB69A), ref: 00007FFE013EE26F

Part of subcall function 00007FFE013ED930: BIO_indent.LIBCRYPTO-3(?,?,?,?,?,?,00007FFE013EBC48), ref: 00007FFE013ED977
Part of subcall function 00007FFE013ED930: BIO_puts.LIBCRYPTO-3(?,?,?,?,?,?,00007FFE013EBC48), ref: 00007FFE013ED98B

Strings

request_extensions, xrefs: 00007FFE013EBFD2
%s (%d), xrefs: 00007FFE013EBCF1
<UNPARSEABLE DN>, xrefs: 00007FFE013EBF2C
DistinguishedName (len=%d): , xrefs: 00007FFE013EBEFE
certificate_types (len=%d), xrefs: 00007FFE013EBC92
UNKNOWN, xrefs: 00007FFE013EBCE1, 00007FFE013EBE0A
signature_algorithms (len=%d), xrefs: 00007FFE013EBD9A
certificate_authorities (len=%d), xrefs: 00007FFE013EBE88
request_context, xrefs: 00007FFE013EBBE7
%s (0x%04x), xrefs: 00007FFE013EBE17

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_printf$O_indent$O_puts$X509_$E_freed2i_
String ID: %s (%d)$%s (0x%04x)$<UNPARSEABLE DN>$DistinguishedName (len=%d): $UNKNOWN$certificate_authorities (len=%d)$certificate_types (len=%d)$request_context$request_extensions$signature_algorithms (len=%d)
API String ID: 2542938528-1289818360
Opcode ID: 09cb34a77d344f66ae2e1094aa644f37e50e77cb632cb4387103ec8815bd88d7
Instruction ID: 5eb6979b1388865efa0fcba57ecf4bc646963a33edd12c18573db6aa5869ddbd
Opcode Fuzzy Hash: 09cb34a77d344f66ae2e1094aa644f37e50e77cb632cb4387103ec8815bd88d7
Instruction Fuzzy Hash: 46C10322B0C7D286EB218F1694057B9AB91FB55B94F498031DE8D4BBF9DE3DE145C700

Function 00007FFE013D9F40 Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013D9F5E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D9F76
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D9F86
ERR_new.LIBCRYPTO-3 ref: 00007FFE013D9FBC
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D9FD4
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D9FE2

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFE013D9F6F, 00007FFE013D9FCD, 00007FFE013DBB7F, 00007FFE013DBBD0, 00007FFE013DBC24
SSL_CTX_use_certificate, xrefs: 00007FFE013D9F63, 00007FFE013D9FC1
ssl_set_cert, xrefs: 00007FFE013DBB73, 00007FFE013DBBC4, 00007FFE013DBC18

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_rsa.c$SSL_CTX_use_certificate$ssl_set_cert
API String ID: 1552677711-1118281239
Opcode ID: 9058d21f45ac6084b89aee5f2db564b627410ef4a597e4f80f776bb43f20b22d
Instruction ID: 22984330fbd5578c3f03d0cd3d32e98b20e19b48965bd1653e4c62c9c59396a6
Opcode Fuzzy Hash: 9058d21f45ac6084b89aee5f2db564b627410ef4a597e4f80f776bb43f20b22d
Instruction Fuzzy Hash: ED61B736B1899282EB40DB15E4916BD6361FBD9BC4F950031EB4D4BBBAEE3CD581C701

Function 00007FFE013B1942 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013CFD59
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013CFD71
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013CFD82
ERR_new.LIBCRYPTO-3 ref: 00007FFE013CFD9E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013CFDB6
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013CFDC7

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013CFD6A, 00007FFE013CFDAF, 00007FFE013CFE0C, 00007FFE013CFE60, 00007FFE013CFECE
SSL_dane_enable, xrefs: 00007FFE013CFD5E, 00007FFE013CFDA3, 00007FFE013CFE00, 00007FFE013CFE54, 00007FFE013CFEC2

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_dane_enable
API String ID: 1552677711-2910236719
Opcode ID: 14efc94addaedfea5c79850d66cb27a32686bf856cd6e481cad7ecfc9f633b77
Instruction ID: ec6b8626e4e202c6a5703887ff0f6122b2d71ec89938d0936772d78d64142247
Opcode Fuzzy Hash: 14efc94addaedfea5c79850d66cb27a32686bf856cd6e481cad7ecfc9f633b77
Instruction Fuzzy Hash: 0E41A271B2898192F790DB24E8817ED2252FF94794FD55231EA1C0FAF6DF2CD4868706

Function 00007FFE013B263F Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3 ref: 00007FFE013D9D2E
BIO_new.LIBCRYPTO-3 ref: 00007FFE013D9D36
ERR_new.LIBCRYPTO-3 ref: 00007FFE013D9D43
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D9D5B
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE013D9D79
ERR_new.LIBCRYPTO-3 ref: 00007FFE013D9D82
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D9D9A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D9E6F
BIO_free.LIBCRYPTO-3 ref: 00007FFE013D9E77

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFE013D9D54, 00007FFE013D9D93, 00007FFE013D9E1A, 00007FFE013D9E57
SSL_CTX_use_PrivateKey_file, xrefs: 00007FFE013D9D48, 00007FFE013D9D87, 00007FFE013D9E0E, 00007FFE013D9E4B

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug$O_ctrlO_freeO_newO_s_fileR_set_error
String ID: ..\s\ssl\ssl_rsa.c$SSL_CTX_use_PrivateKey_file
API String ID: 1899708915-2252211958
Opcode ID: 7ff33d9e07edc6b1d1863f777273607fef71df5255b78d6fb528ed6f94d8f93d
Instruction ID: 5440db34844d2ad908147fda82ed2e316bca439407a302cb4281ff7dfeb8bb8a
Opcode Fuzzy Hash: 7ff33d9e07edc6b1d1863f777273607fef71df5255b78d6fb528ed6f94d8f93d
Instruction Fuzzy Hash: AF418131A1CA4292F750EB51E8412FD6352FF98B84F954032E98C4FBB6DE3CE5868701

Function 00007FFE013B222A Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE0140BF8D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140BFA5
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140C03E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140C056
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140C077
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140C08F
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140C28D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140C2A5

Strings

tls_parse_ctos_key_share, xrefs: 00007FFE0140BF92, 00007FFE0140C043, 00007FFE0140C081, 00007FFE0140C223, 00007FFE0140C24D, 00007FFE0140C297
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFE0140BF9E, 00007FFE0140C04F, 00007FFE0140C088, 00007FFE0140C22F, 00007FFE0140C259, 00007FFE0140C29E

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_key_share
API String ID: 193678381-166674739
Opcode ID: c87ebdfa8a0f7a67168768347dfb568b9aed920fe9afcc19bf1f70962f8e10de
Instruction ID: 7b5eea5809f71dfd8a72c6ef3a44f40eff6abbdf72910af95eb4f74c79385e0a
Opcode Fuzzy Hash: c87ebdfa8a0f7a67168768347dfb568b9aed920fe9afcc19bf1f70962f8e10de
Instruction Fuzzy Hash: 4D9116B1E19692C1F7519BA294802BE2791EF91784F45423AED4D5FAF6CF3CE982C700

Function 00007FFE013C5CA0 Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 101stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE013C5CD6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE013C5D07
ERR_new.LIBCRYPTO-3 ref: 00007FFE013C5DA0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013C5DB8
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013C5DC9

Strings

ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFE013C5DEC
..\s\ssl\ssl_ciph.c, xrefs: 00007FFE013C5DB1
check_suiteb_cipher_list, xrefs: 00007FFE013C5DA5
SUITEB192, xrefs: 00007FFE013C5D59
ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFE013C5DF3, 00007FFE013C5E03
SUITEB128C2, xrefs: 00007FFE013C5CFA
SUITEB128, xrefs: 00007FFE013C5D2B
SUITEB128ONLY, xrefs: 00007FFE013C5CCA
ECDHE-ECDSA-AES128-GCM-SHA256, xrefs: 00007FFE013C5E0F

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: strncmp$R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_ciph.c$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192$check_suiteb_cipher_list
API String ID: 1930259724-1099454403
Opcode ID: 4fb00667328cc24e5a01ced80a969a7b37fcff98c645767f26b4f54dc518abc7
Instruction ID: 5d620cf3b0388947db35b32b6ae0f1f833bf503ed4218934368eadbeb2aed4f8
Opcode Fuzzy Hash: 4fb00667328cc24e5a01ced80a969a7b37fcff98c645767f26b4f54dc518abc7
Instruction Fuzzy Hash: 20416F32F18A4396E7108B21E8543B977A0EB44B94F458435EA0ECB6B5DF6CF5A5CB01

Function 00007FFE013B1C67 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01415B54
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01415B6C
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFE01415BA1
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFE01415BB6
X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FFE01415BC1
ERR_new.LIBCRYPTO-3 ref: 00007FFE01415BF7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01415C0F
ERR_new.LIBCRYPTO-3 ref: 00007FFE01415C54
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01415C6C

Strings

tls_post_process_server_certificate, xrefs: 00007FFE01415B59, 00007FFE01415BFC, 00007FFE01415C59, 00007FFE01415D2B
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE01415B65, 00007FFE01415C08, 00007FFE01415C65, 00007FFE01415D37

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug$L_sk_valueR_clear_errorX509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$tls_post_process_server_certificate
API String ID: 2779586248-3767186838
Opcode ID: 83b60e124ffb344b91694eee76e59e26672e35621eca384badca9d95ee8817b9
Instruction ID: 4415bf8ea4453580afd51c9c4deb674779f7e0b2595a542772ff4fb3798ddbc4
Opcode Fuzzy Hash: 83b60e124ffb344b91694eee76e59e26672e35621eca384badca9d95ee8817b9
Instruction Fuzzy Hash: 32515961A1968282F750EB25D4957FD23A1EBD5B84F984031EE0D8F7B6DF2DE982C700

Function 00007FF77C6381C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77C639400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF77C6345E4,00000000,00007FF77C631985), ref: 00007FF77C639439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF77C6388A7,?,?,00000000,00007FF77C633CBB), ref: 00007FF77C63821C

Part of subcall function 00007FF77C632810: MessageBoxW.USER32 ref: 00007FF77C6328EA

Strings

%.*s, xrefs: 00007FF77C6382FC
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF77C6381F3
CreateDirectory, xrefs: 00007FF77C63836C
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF77C63828D
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF77C638363
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF77C638230
\, xrefs: 00007FF77C638251
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF77C6382C9

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 6fbdb188916104b0c2c5940302cfd80688c9116ecc918f500a0c860990a20752
Instruction ID: b4795c968364faee0818537591df4f752c2475f69d1f9ffb18c0df18257a8dfb
Opcode Fuzzy Hash: 6fbdb188916104b0c2c5940302cfd80688c9116ecc918f500a0c860990a20752
Instruction Fuzzy Hash: 92517513B3C64241FB52BB61A9D16BBE253AF9C780FD44032DB0EC66D6EE2CE5058760

Function 00007FFE013B1825 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

BIO_s_socket.LIBCRYPTO-3 ref: 00007FFE013D3FAD
BIO_new.LIBCRYPTO-3 ref: 00007FFE013D3FB5
ERR_new.LIBCRYPTO-3 ref: 00007FFE013D3FC2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D3FDA
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D3FEA
BIO_int_ctrl.LIBCRYPTO-3 ref: 00007FFE013D400E
BIO_next.LIBCRYPTO-3 ref: 00007FFE013D4022
BIO_up_ref.LIBCRYPTO-3 ref: 00007FFE013D4035
BIO_next.LIBCRYPTO-3 ref: 00007FFE013D4049
BIO_next.LIBCRYPTO-3 ref: 00007FFE013D4062
BIO_free_all.LIBCRYPTO-3 ref: 00007FFE013D4076

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013D3FD3
SSL_set_fd, xrefs: 00007FFE013D3FC7

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_next$O_free_allO_int_ctrlO_newO_s_socketO_up_refR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_set_fd
API String ID: 2935861444-3152457077
Opcode ID: 479d6d7357ba75fe30c4083dc38e7f087118b597f0ac9a52a685430553148854
Instruction ID: 1a0e0870d217c858e86b0797f7bbced71e5c9bc89dadd4b25f560438fedd9b28
Opcode Fuzzy Hash: 479d6d7357ba75fe30c4083dc38e7f087118b597f0ac9a52a685430553148854
Instruction Fuzzy Hash: 08317221F1960282EB64EB61E55117C9361EF94BC4F450431EA4E4FFFADE7DE8908351

Function 00007FFE013B1096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 180COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01415E72
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01415E8A

Strings

tls_prepare_client_certificate, xrefs: 00007FFE01415E77, 00007FFE0141600D, 00007FFE01416092
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE01415E83, 00007FFE01416019, 00007FFE0141609E

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_prepare_client_certificate
API String ID: 193678381-816577172
Opcode ID: dee5604ec6b15b605cd02077c3f2e835f61ed60e0dd710c374edb6aeed88eca8
Instruction ID: b0ae4d817e8828ed66b08ec3e9232b43e56f03daf9e716b94d9c75f34ffa369d
Opcode Fuzzy Hash: dee5604ec6b15b605cd02077c3f2e835f61ed60e0dd710c374edb6aeed88eca8
Instruction Fuzzy Hash: F3716E72B1864282EB50DB15E4906FD67A1EFC5B84F995032EB4D4F6BADF2DE881C700

Function 00007FF77C631600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF77C6316DA
Failed to extract %s: failed to open archive file!, xrefs: 00007FF77C6316A2
Failed to extract %s: failed to open target file!, xrefs: 00007FF77C63165C
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF77C631742
fread, xrefs: 00007FF77C6317E6
malloc, xrefs: 00007FF77C631749
fwrite, xrefs: 00007FF77C6317D1
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF77C6317DF
fseek, xrefs: 00007FF77C6316E1
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF77C6317CA
Failed to create symbolic link %s!, xrefs: 00007FF77C631622
fopen, xrefs: 00007FF77C631663

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 4c7fe1244eef98df2bcb46fd1baa582529a9c283c7dafe045e7b476fd79c6f5c
Instruction ID: 908a1b350d62b9c65f70f82d3611bbacc2d3698607f407ec5d4a5af64406cb9b
Opcode Fuzzy Hash: 4c7fe1244eef98df2bcb46fd1baa582529a9c283c7dafe045e7b476fd79c6f5c
Instruction Fuzzy Hash: 0E51A263B3864292EB12BB51A4801BBE362BF8D794FD44531EE1C877D2DE3CE6458360

Function 00007FFE01419BA0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(00000000,00007FFE0141736A), ref: 00007FFE01419C44
ERR_set_debug.LIBCRYPTO-3(00000000,00007FFE0141736A), ref: 00007FFE01419C5C
ERR_new.LIBCRYPTO-3(00000000,00007FFE0141736A), ref: 00007FFE01419CE9
ERR_set_debug.LIBCRYPTO-3(00000000,00007FFE0141736A), ref: 00007FFE01419D01
X509_get0_pubkey.LIBCRYPTO-3(00000000,00007FFE0141736A), ref: 00007FFE01419D3A
ERR_new.LIBCRYPTO-3(00000000,00007FFE0141736A), ref: 00007FFE01419D59
ERR_set_debug.LIBCRYPTO-3(00000000,00007FFE0141736A), ref: 00007FFE01419D71
ERR_new.LIBCRYPTO-3(00000000,00007FFE0141736A), ref: 00007FFE01419D86
ERR_set_debug.LIBCRYPTO-3(00000000,00007FFE0141736A), ref: 00007FFE01419D9E
ERR_new.LIBCRYPTO-3(00000000,00007FFE0141736A), ref: 00007FFE01419DB5
ERR_set_debug.LIBCRYPTO-3(00000000,00007FFE0141736A), ref: 00007FFE01419DCD

Strings

tls_process_ske_ecdhe, xrefs: 00007FFE01419C49, 00007FFE01419CEE, 00007FFE01419D5E, 00007FFE01419D8B, 00007FFE01419DBA
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE01419C55, 00007FFE01419CFA, 00007FFE01419D6A, 00007FFE01419D97, 00007FFE01419DC6

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug$X509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_ske_ecdhe
API String ID: 2988517565-1997102834
Opcode ID: 71f247ce7876683505c4b4ad72114123cf5f156a41cfb06cc1aa6d529bca82bd
Instruction ID: 9da24fabd4f6215d97f889bb9f3f8a756b6eeb1dcab0a31515df22f20b1c37ea
Opcode Fuzzy Hash: 71f247ce7876683505c4b4ad72114123cf5f156a41cfb06cc1aa6d529bca82bd
Instruction Fuzzy Hash: D9518032A18A8282E750DB61E4A16BD7761FB94784F844032DF8D4BBB6EF3CE591C740

Function 00007FFE013B14EC Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 206COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFE013F7DF0
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F7E8C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F7EA4
SetLastError.KERNEL32 ref: 00007FFE013F7EF5
BIO_read.LIBCRYPTO-3 ref: 00007FFE013F7F1C
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE013F7FA4
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F7FD3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F7FEB
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F8007
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F801F

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFE013F7E9D, 00007FFE013F7FE4, 00007FFE013F8018
ssl3_read_n, xrefs: 00007FFE013F7E91, 00007FFE013F7FD8, 00007FFE013F800C

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug$ErrorLastO_ctrlO_readmemmove
String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_read_n
API String ID: 4133841363-4226281315
Opcode ID: 037e7d2359cd23bf12120f1dd39d7f25bfb9e7f9f6dfcd92e2dd4aaa52ab750d
Instruction ID: 7a24ce2c8867ef20d5c1c042049fd4050f37b838272e29b700430096e3e18916
Opcode Fuzzy Hash: 037e7d2359cd23bf12120f1dd39d7f25bfb9e7f9f6dfcd92e2dd4aaa52ab750d
Instruction Fuzzy Hash: 72916B32A0868282FB50AF25D4547BD36A1EB50BD8F99413ADE4C1FAB9DF7CE845C350

Function 00007FFDFAAF4804 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 93COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFAAF4849
PyUnicode_Compare.PYTHON312 ref: 00007FFDFAAF48AC
_Py_Dealloc.PYTHON312 ref: 00007FFDFAAF48C2

Strings

NFD, xrefs: 00007FFDFAAF48EC
NFC, xrefs: 00007FFDFAAF4835
invalid normalization form, xrefs: 00007FFDFAAF4926
NFKC, xrefs: 00007FFDFAAF48CC
NFKD, xrefs: 00007FFDFAAF4904

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: CompareUnicode_$DeallocStringWith
String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
API String ID: 1004266020-3528878251
Opcode ID: cf64f6b9ab75cd253386f0f7453e80a2405618faa649494653d4230b278f9e28
Instruction ID: f5a5b0feb859e409e885b55ac2542dd9660fb8b5e4087acbce4f9983859bc796
Opcode Fuzzy Hash: cf64f6b9ab75cd253386f0f7453e80a2405618faa649494653d4230b278f9e28
Instruction Fuzzy Hash: 6A414C21B087C382EF1C9B11E9B0A3973A5AF45B85F9440B5C9BE477D8DF2EE44A8344

Function 00007FFDFAAF24D0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PyModule_AddStringConstant.PYTHON312 ref: 00007FFDFAAF24F0
PyType_FromSpec.PYTHON312 ref: 00007FFDFAAF2505
PyModule_AddType.PYTHON312 ref: 00007FFDFAAF251D
_Py_Dealloc.PYTHON312 ref: 00007FFDFAAF3E86

Part of subcall function 00007FFDFAAF25C0: _PyObject_GC_New.PYTHON312(?,?,00000000,00007FFDFAAF2533), ref: 00007FFDFAAF25C6
Part of subcall function 00007FFDFAAF25C0: PyObject_GC_Track.PYTHON312(?,?,00000000,00007FFDFAAF2533), ref: 00007FFDFAAF25F8

PyModule_AddObject.PYTHON312 ref: 00007FFDFAAF2557
PyModule_AddObjectRef.PYTHON312 ref: 00007FFDFAAF257F
_Py_Dealloc.PYTHON312 ref: 00007FFDFAAF3E95

Strings

_ucnhash_CAPI, xrefs: 00007FFDFAAF2575
ucd_3_2_0, xrefs: 00007FFDFAAF254D
unidata_version, xrefs: 00007FFDFAAF24E9
15.0.0, xrefs: 00007FFDFAAF24DF

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Module_$DeallocObjectObject_$ConstantFromSpecStringTrackTypeType_
String ID: 15.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
API String ID: 2663085338-4141011787
Opcode ID: 6b398be3fd63e60b8eeee9a963b5b24ee277b0b0407f88d061c760d12a720801
Instruction ID: 3ce667b8d3e5f9b1e2151f0d87661ddb0e52f7ef0a1ec427dc349d64a686d58a
Opcode Fuzzy Hash: 6b398be3fd63e60b8eeee9a963b5b24ee277b0b0407f88d061c760d12a720801
Instruction Fuzzy Hash: 93310721B09B8385FB1D6B25E834A7837A5AF49B80F4451B8D93E4A6DDDF3DE44E8700

Function 00007FFE013D7D90 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFE013D7DCD
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFE013D7DD5
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFE013D7DE8
ERR_new.LIBCRYPTO-3 ref: 00007FFE013D7DF5
EVP_MD_CTX_copy_ex.LIBCRYPTO-3 ref: 00007FFE013D7E07
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FFE013D7E19
ERR_new.LIBCRYPTO-3 ref: 00007FFE013D7E38
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D7E50
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFE013D7E6D

Strings

ssl_handshake_hash, xrefs: 00007FFE013D7E42
..\s\ssl\ssl_lib.c, xrefs: 00007FFE013D7E49

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_new$D_get_sizeDigestFinal_exR_set_debugX_copy_exX_freeX_get0_mdX_new
String ID: ..\s\ssl\ssl_lib.c$ssl_handshake_hash
API String ID: 474506514-3232504857
Opcode ID: 26a78cc74c6525379c245ac701a5a25562961fbecfcc77c97844b5b064d4b887
Instruction ID: 4a5d5766fb351b08430e09b592523b2961651515f7f878f2d03dc3c7a124950a
Opcode Fuzzy Hash: 26a78cc74c6525379c245ac701a5a25562961fbecfcc77c97844b5b064d4b887
Instruction Fuzzy Hash: 6321B021F0865352F720AB62BC919BE6651AF90BC4F460431FE4D4F7B6EE3CE8828341

Function 00007FFDFAAF11B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 152COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFAAF11E2
PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFAAF11FA
PyType_IsSubtype.PYTHON312 ref: 00007FFDFAAF121D

Part of subcall function 00007FFDFAAF12F0: PyMem_Malloc.PYTHON312 ref: 00007FFDFAAF1377
Part of subcall function 00007FFDFAAF12F0: PyMem_Free.PYTHON312 ref: 00007FFDFAAF1487

PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFAAF369B

Strings

NFD, xrefs: 00007FFDFAAF3691
NFC, xrefs: 00007FFDFAAF11D8
invalid normalization form, xrefs: 00007FFDFAAF3733
NFKC, xrefs: 00007FFDFAAF11F0
NFKD, xrefs: 00007FFDFAAF36D7

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: CompareStringUnicode_With$Mem_$FreeMallocSubtypeType_
String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
API String ID: 1723213316-3528878251
Opcode ID: 7d9693cf2d06923f90061d591c3b8a3e1c636af1e984342259c0b7d751c99e14
Instruction ID: 8a17c557870147858b427558df18106f893ff9db3e72287f9a0d3a1ab6b8c2fd
Opcode Fuzzy Hash: 7d9693cf2d06923f90061d591c3b8a3e1c636af1e984342259c0b7d751c99e14
Instruction Fuzzy Hash: 2A516F21B0C7D342FB6D9BA59870E797395AF52BC0F4451B1CA6A86ACDDF2DE40B8700

Function 00007FFE013EDB50 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,00007FFE013EB5EE), ref: 00007FFE013EDBBA
BIO_printf.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,00007FFE013EB5EE), ref: 00007FFE013EDBFE
BIO_indent.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,00007FFE013EB5EE), ref: 00007FFE013EDC55
BIO_printf.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,00007FFE013EB5EE), ref: 00007FFE013EDCAE

Strings

%s, Length=%d, xrefs: 00007FFE013EDBF4
UNKNOWN, xrefs: 00007FFE013EDBD0
message_seq=%d, fragment_offset=%d, fragment_length=%d, xrefs: 00007FFE013EDC5F
Unsupported, hex dump follows:, xrefs: 00007FFE013EE01F

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s, Length=%d$UNKNOWN$Unsupported, hex dump follows:$message_seq=%d, fragment_offset=%d, fragment_length=%d
API String ID: 1860387303-4198474627
Opcode ID: 33a47e38e1b46a6264f8e460a0306516b777e661874f5575458a500ab7b74889
Instruction ID: 56cd08b39eb19d25c87fc1bb2cb9dfababd7b99c780e4562a3b96e8743633eaf
Opcode Fuzzy Hash: 33a47e38e1b46a6264f8e460a0306516b777e661874f5575458a500ab7b74889
Instruction Fuzzy Hash: D0512362B0C6E146E724CB29A844A7E7BE1EB817D5F448135EEAD4BBE9DE3CD041C700

Function 00007FFE013B1019 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01405E1B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01405E33
ERR_new.LIBCRYPTO-3 ref: 00007FFE01405F02
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01405F1A
ERR_new.LIBCRYPTO-3 ref: 00007FFE01405F26
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01405F3E
ERR_new.LIBCRYPTO-3 ref: 00007FFE01405FA4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01405FBC

Strings

ssl_next_proto_validate, xrefs: 00007FFE01405F2B
tls_parse_stoc_npn, xrefs: 00007FFE01405E20, 00007FFE01405F07, 00007FFE01405FA9
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFE01405E2C, 00007FFE01405F13, 00007FFE01405F37, 00007FFE01405F68, 00007FFE01405F7F, 00007FFE01405FB5

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$ssl_next_proto_validate$tls_parse_stoc_npn
API String ID: 193678381-2899453981
Opcode ID: 2fd302556afe2def7f58921f5571200c01d2190c6ab98bcf53c621c0c59e4bd4
Instruction ID: c82bc5c899d34d83600b743f1edd49aa66c29ffbaf86db7c600baf4140baaf7c
Opcode Fuzzy Hash: 2fd302556afe2def7f58921f5571200c01d2190c6ab98bcf53c621c0c59e4bd4
Instruction Fuzzy Hash: B851E471A1AB8682FB409B61E4907FD27A1EF94B44F884035EA4D4F7B5EF3CE5818B40

Function 00007FFDFAAF43F0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 109COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAAF4420
PyType_IsSubtype.PYTHON312 ref: 00007FFDFAAF4483
PyUnicode_FromString.PYTHON312 ref: 00007FFDFAAF449F

Strings

argument, xrefs: 00007FFDFAAF4412
decomposition, xrefs: 00007FFDFAAF4419
a unicode character, xrefs: 00007FFDFAAF440B
, xrefs: 00007FFDFAAF4533
%04X, xrefs: 00007FFDFAAF4548

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: $%04X$a unicode character$argument$decomposition
API String ID: 1318908108-4056541097
Opcode ID: a3cef0d0996400cfa83e251a2d781e139d471a14dd81ecf0aeeb3af5fef58597
Instruction ID: 3b4e24518b66f6d2c0848589eb6c104628f5c44a14b2be85cec6795e874691df
Opcode Fuzzy Hash: a3cef0d0996400cfa83e251a2d781e139d471a14dd81ecf0aeeb3af5fef58597
Instruction Fuzzy Hash: 9B41B4A2B08BC282EB2D9B15D860AB937A1FF45795F844275C97E176D8DF3CE54B8300

Function 00007FF77C632180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF77C6321AB
SelectObject.GDI32 ref: 00007FF77C6321F2
DrawTextW.USER32 ref: 00007FF77C632215
SelectObject.GDI32 ref: 00007FF77C63222B
ReleaseDC.USER32 ref: 00007FF77C63223B
MoveWindow.USER32 ref: 00007FF77C63228B
MoveWindow.USER32 ref: 00007FF77C6322CB
MoveWindow.USER32 ref: 00007FF77C63231E
MoveWindow.USER32 ref: 00007FF77C632366

Strings

P%, xrefs: 00007FF77C6321FF

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: be180701450347c49b5ca29539e970a7d9caaae2e24e4650ffb24c923fce21bf
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: AB51D5366287A186D7349F26B4581BBB7A2FB98B61F004121EFDE83695DF3CD045DB20

Function 00007FFE013B2329 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01421DD7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01421DEF
ERR_new.LIBCRYPTO-3 ref: 00007FFE01421E14
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01421E2C
ERR_new.LIBCRYPTO-3 ref: 00007FFE01421E55
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01421E6D
ERR_new.LIBCRYPTO-3 ref: 00007FFE01421EA3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01421EBB

Strings

tls_process_change_cipher_spec, xrefs: 00007FFE01421DDC, 00007FFE01421E19, 00007FFE01421E5A, 00007FFE01421EA8
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFE01421DE8, 00007FFE01421E25, 00007FFE01421E66, 00007FFE01421EB4

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_process_change_cipher_spec
API String ID: 193678381-3810074443
Opcode ID: 94a27043d840fc91a8f4279131916f013933d917ca0c9531099949c38a6303d0
Instruction ID: 0ab6702353b0ce45f2c2ab9b38fd0fc520a35fe5f7cfb40539308f30d14abc74
Opcode Fuzzy Hash: 94a27043d840fc91a8f4279131916f013933d917ca0c9531099949c38a6303d0
Instruction Fuzzy Hash: 4B418075E1818292FB95EBA1D8917FD2391EFA4B94F844431DA0C4B6F1DF6CA5C2C311

Function 00007FF77C6380B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF77C6380EF
GetWindowLongPtrW.USER32 ref: 00007FF77C63816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF77C638182
GetLastError.KERNEL32 ref: 00007FF77C63818C
SetWindowLongPtrW.USER32 ref: 00007FF77C6381A3

Strings

Needs to remove its temporary files., xrefs: 00007FF77C638175

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: c70121ada4e028e0be351826aa30a68c010c1f9b981b2844ad93ef5d9bcf0dff
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: 1F213523B38A4281E7566B79B89417BA252EFCCF90F984131DF2DC3394DE2CD5918321

Function 00007FFDFF3F1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDFF3F1058
__scrt_initialize_crt.LIBCMT ref: 00007FFDFF3F109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDFF3F10AA
_RTC_Initialize.LIBCMT ref: 00007FFDFF3F10D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDFF3F10FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFDFF3F1129

Memory Dump Source

Source File: 00000001.00000002.1789715337.00007FFDFF3F1000.00000020.00000001.01000000.0000003C.sdmp, Offset: 00007FFDFF3F0000, based on PE: true

Associated: 00000001.00000002.1789684258.00007FFDFF3F0000.00000002.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789751805.00007FFDFF3F3000.00000002.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789778567.00007FFDFF3F4000.00000004.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789802581.00007FFDFF3F5000.00000002.00000001.01000000.0000003C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff3f0000_lz4wnSavmK.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 31d8e522e61a33cf479bf52350be3450eaa8bff41c9a3cd264d2142d6b397c0f
Instruction ID: c2644960ef25b0c722177943b04a9d52fb611766a3c64cca2c52e9dcfdb91f10
Opcode Fuzzy Hash: 31d8e522e61a33cf479bf52350be3450eaa8bff41c9a3cd264d2142d6b397c0f
Instruction Fuzzy Hash: 08812661F182C387EB58BB66B461AB963D0AF95780F484235D93D9E7DEDF2CE8058600

Function 00007FFDFF6D1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDFF6D1058
__scrt_initialize_crt.LIBCMT ref: 00007FFDFF6D109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDFF6D10AA
_RTC_Initialize.LIBCMT ref: 00007FFDFF6D10D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDFF6D10FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFDFF6D1129

Memory Dump Source

Source File: 00000001.00000002.1790153239.00007FFDFF6D1000.00000020.00000001.01000000.00000038.sdmp, Offset: 00007FFDFF6D0000, based on PE: true

Associated: 00000001.00000002.1790132929.00007FFDFF6D0000.00000002.00000001.01000000.00000038.sdmpDownload File
Associated: 00000001.00000002.1790172913.00007FFDFF6D3000.00000002.00000001.01000000.00000038.sdmpDownload File
Associated: 00000001.00000002.1790196351.00007FFDFF6D5000.00000002.00000001.01000000.00000038.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff6d0000_lz4wnSavmK.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 2e347b0b31fdc3b33f3650616a24c4580738b1cdf7c2697dd32cd46ce7f28e42
Instruction ID: 8e71e72237d276532a9342a69ef36a4ca29821256576c40412bef07cba2d9b68
Opcode Fuzzy Hash: 2e347b0b31fdc3b33f3650616a24c4580738b1cdf7c2697dd32cd46ce7f28e42
Instruction Fuzzy Hash: 21818C61F0C34786FB50AB66A861ABD639CAF95780F444335D93C977DEDEBCE8428600

Function 00007FFDFF6A12CC Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDFF6A12F4
__scrt_initialize_crt.LIBCMT ref: 00007FFDFF6A1339
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDFF6A1346
_RTC_Initialize.LIBCMT ref: 00007FFDFF6A1374
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDFF6A139A
__scrt_release_startup_lock.LIBCMT ref: 00007FFDFF6A13C5

Memory Dump Source

Source File: 00000001.00000002.1789939538.00007FFDFF6A1000.00000020.00000001.01000000.0000003A.sdmp, Offset: 00007FFDFF6A0000, based on PE: true

Associated: 00000001.00000002.1789917112.00007FFDFF6A0000.00000002.00000001.01000000.0000003A.sdmpDownload File
Associated: 00000001.00000002.1789963055.00007FFDFF6A5000.00000002.00000001.01000000.0000003A.sdmpDownload File
Associated: 00000001.00000002.1789984878.00007FFDFF6AF000.00000004.00000001.01000000.0000003A.sdmpDownload File
Associated: 00000001.00000002.1790005078.00007FFDFF6B0000.00000002.00000001.01000000.0000003A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff6a0000_lz4wnSavmK.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 25c34cf625cfd52ada091fdb65a0fc74a29e9636dd4e47856e36c618d7ae6fa2
Instruction ID: 30e71bae89ea8046a390083d6505bace3d96219db9eaddb0e41188773e9ceac3
Opcode Fuzzy Hash: 25c34cf625cfd52ada091fdb65a0fc74a29e9636dd4e47856e36c618d7ae6fa2
Instruction Fuzzy Hash: 83819E63F0864346F7509B669461AB963D8AF55B80F448735DA3D8F7DEEE3CE8418B00

Function 00007FFDFAAF2740 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDFAAF2768
__scrt_initialize_crt.LIBCMT ref: 00007FFDFAAF27AD
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDFAAF27BA
_RTC_Initialize.LIBCMT ref: 00007FFDFAAF27E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDFAAF280E
__scrt_release_startup_lock.LIBCMT ref: 00007FFDFAAF2839

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: ba629577db6599826cb9fb44cf19b8c727e776d8ab71a1e0ce86f35fe3adb7c8
Instruction ID: 7a32b4041457520fd3536344e255c4338e67a2e10e41e8ac8832686c3aed3b1c
Opcode Fuzzy Hash: ba629577db6599826cb9fb44cf19b8c727e776d8ab71a1e0ce86f35fe3adb7c8
Instruction Fuzzy Hash: 9681AF20F087C346FB6CAB659461AB937A0AF85780F1481B5D96C477EEDE3CE84F8200

Function 00007FFDFF6C1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDFF6C1058
__scrt_initialize_crt.LIBCMT ref: 00007FFDFF6C109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDFF6C10AA
_RTC_Initialize.LIBCMT ref: 00007FFDFF6C10D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDFF6C10FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFDFF6C1129

Memory Dump Source

Source File: 00000001.00000002.1790050435.00007FFDFF6C1000.00000020.00000001.01000000.00000039.sdmp, Offset: 00007FFDFF6C0000, based on PE: true

Associated: 00000001.00000002.1790028351.00007FFDFF6C0000.00000002.00000001.01000000.00000039.sdmpDownload File
Associated: 00000001.00000002.1790073229.00007FFDFF6C4000.00000002.00000001.01000000.00000039.sdmpDownload File
Associated: 00000001.00000002.1790092982.00007FFDFF6C5000.00000004.00000001.01000000.00000039.sdmpDownload File
Associated: 00000001.00000002.1790113402.00007FFDFF6C6000.00000002.00000001.01000000.00000039.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff6c0000_lz4wnSavmK.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: d8b20e02c901b865873e7091ce4e44ae4228cf79fcdaf74b4f9438ea969cd35b
Instruction ID: 1c20eb6068346ae7a2632791990dd32b123fa5911256c225b9075a6b5360544f
Opcode Fuzzy Hash: d8b20e02c901b865873e7091ce4e44ae4228cf79fcdaf74b4f9438ea969cd35b
Instruction Fuzzy Hash: 3881AE61F0824786F750BB669471A7923AAAF55B86F444335D9FC83BDEDE3CE8428600

Function 00007FFDFF691030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDFF691058
__scrt_initialize_crt.LIBCMT ref: 00007FFDFF69109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDFF6910AA
_RTC_Initialize.LIBCMT ref: 00007FFDFF6910D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDFF6910FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFDFF691129

Memory Dump Source

Source File: 00000001.00000002.1789848549.00007FFDFF691000.00000020.00000001.01000000.0000003B.sdmp, Offset: 00007FFDFF690000, based on PE: true

Associated: 00000001.00000002.1789825319.00007FFDFF690000.00000002.00000001.01000000.0000003B.sdmpDownload File
Associated: 00000001.00000002.1789873449.00007FFDFF696000.00000002.00000001.01000000.0000003B.sdmpDownload File
Associated: 00000001.00000002.1789896284.00007FFDFF69B000.00000002.00000001.01000000.0000003B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff690000_lz4wnSavmK.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 3667c9311effcda5bebfcd6f0c463b07b4ccdab133b9d1969c09bf43b1d98b8c
Instruction ID: 9e5e3bbfb64533c2c45d5cd2bae71ac90d88a84de096de7f07502c98df2dcbaf
Opcode Fuzzy Hash: 3667c9311effcda5bebfcd6f0c463b07b4ccdab133b9d1969c09bf43b1d98b8c
Instruction Fuzzy Hash: 5D819A61F0C24346FB70AB669461AB923A8EF9578CF644335D93D877DEDE3DE8428600

Function 00007FFE013D5BE0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3(?,00007FFE013D117C), ref: 00007FFE013D5C13
ERR_new.LIBCRYPTO-3(?,00007FFE013D117C), ref: 00007FFE013D5C20
ERR_set_debug.LIBCRYPTO-3(?,00007FFE013D117C), ref: 00007FFE013D5C38
ERR_set_error.LIBCRYPTO-3(?,00007FFE013D117C), ref: 00007FFE013D5C48
OPENSSL_sk_push.LIBCRYPTO-3(?,00007FFE013D117C), ref: 00007FFE013D5C77
OPENSSL_sk_pop.LIBCRYPTO-3(?,00007FFE013D117C), ref: 00007FFE013D5C85
OPENSSL_sk_push.LIBCRYPTO-3(?,00007FFE013D117C), ref: 00007FFE013D5CBA

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013D5C31
ct_move_scts, xrefs: 00007FFE013D5C25

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: L_sk_push$L_sk_new_nullL_sk_popR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ct_move_scts
API String ID: 2315003219-2572802885
Opcode ID: 8365ea5b33b0477ef336b7f4614f36468769bd7fa5d506411c600347fb932b93
Instruction ID: 565734a55bf2702acfd12df2876716a56505e668aa1aa28c5b84ef030d3ec1a0
Opcode Fuzzy Hash: 8365ea5b33b0477ef336b7f4614f36468769bd7fa5d506411c600347fb932b93
Instruction Fuzzy Hash: 5C215021F1D74242FF55EB15A8502BD62A4AF94B80F494135EA8D4FBB6EF3CE4428701

Function 00007FFDFAAF45B4 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFDFAAF45E7
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAAF461C
_PyUnicode_ToDigit.PYTHON312 ref: 00007FFDFAAF463E
PyErr_SetString.PYTHON312 ref: 00007FFDFAAF465E
PyLong_FromLong.PYTHON312 ref: 00007FFDFAAF4678

Strings

argument 1, xrefs: 00007FFDFAAF4615
digit, xrefs: 00007FFDFAAF45E0, 00007FFDFAAF460E
not a digit, xrefs: 00007FFDFAAF4654
a unicode character, xrefs: 00007FFDFAAF4607

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Arg_$ArgumentCheckDigitErr_FromLongLong_PositionalStringUnicode_
String ID: a unicode character$argument 1$digit$not a digit
API String ID: 4245020737-4278345224
Opcode ID: 63a51ef3fb3b37699c37d838a5587871e01ab33192532b5daca7f17e7c8dcafb
Instruction ID: 3071cd4236ec1f6ae7d215cc16c0aa85ca3d7a0e0beeea1aed000257308f820d
Opcode Fuzzy Hash: 63a51ef3fb3b37699c37d838a5587871e01ab33192532b5daca7f17e7c8dcafb
Instruction Fuzzy Hash: EC210C31B0878396EB5C9B65E86097973A5EB54B84F8440B1DA2E476ECDF2CE54A8700

Function 00007FFDFAC64AB0 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 325COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAC64E18

Strings

Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FFDFAC64C33
UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FFDFAC64E5C
Cannot add a PRIMARY KEY column, xrefs: 00007FFDFAC64BC8
Cannot add a column with non-constant default, xrefs: 00007FFDFAC64CAF
cannot add a STORED column, xrefs: 00007FFDFAC64DB4
Cannot add a NOT NULL column with default value NULL, xrefs: 00007FFDFAC64C55
SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FFDFAC64C3D, 00007FFDFAC64CB9, 00007FFDFAC64DC3
SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*', xrefs: 00007FFDFAC64F91
Cannot add a UNIQUE column, xrefs: 00007FFDFAC64BE3

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memcpy
String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*'$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
API String ID: 3510742995-3865411212
Opcode ID: 6145248e7b04b0619e5a8fcb440d0d42fd806850070c73835079349b62662a14
Instruction ID: f7051cf7862b96676bbc9dddb8e2937a5bc759f19a4225504130363655152b2f
Opcode Fuzzy Hash: 6145248e7b04b0619e5a8fcb440d0d42fd806850070c73835079349b62662a14
Instruction Fuzzy Hash: 3FE1792AB09A8681EB69CB15D764BBD37A5FB84B88F0440B1DE6D07BD9DF3CE4558300

Function 00007FF77C646300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C646343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C646730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6469CC

Strings

p, xrefs: 00007FF77C6463F5
f, xrefs: 00007FF77C646465
-, xrefs: 00007FF77C6463D9
p, xrefs: 00007FF77C64646D
:, xrefs: 00007FF77C6464FC

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 91926c82e6b76e1147182d4e737ab68119a92b102291a1875d959d8cbb4e90c1
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 701283A3A3C15386FB267B14D1942BBB693FB48754FC44435E6898E6C4DB7CE7808B20

Function 00007FF77C641038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C641078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C641440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6416DF

Strings

p, xrefs: 00007FF77C64111D
f, xrefs: 00007FF77C6412C5
f, xrefs: 00007FF77C64117A
f, xrefs: 00007FF77C641110
p, xrefs: 00007FF77C641182

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: fac51973bd1196917c338ec96bc6720873c6b21acca37337ae2970885ffdf184
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 4A1274A3E3C14785FB22BA15E09467BF663EB44754FE84035D699CA9C4DB7CE7808B20

Function 00007FFDFF3F2760 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF3F27DA
memcpy.VCRUNTIME140 ref: 00007FFDFF3F27FC
_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF3F286E

Strings

src/AESNI.c, xrefs: 00007FFDFF3F27CC
((Nk==4) && (Nr==10)) || ((Nk==6) && (Nr==12)) || ((Nk==8) && (Nr==14)), xrefs: 00007FFDFF3F27D3
src/AESNI.c, xrefs: 00007FFDFF3F2860, 00007FFDFF3F298D
(idx>=1) && (idx<=10), xrefs: 00007FFDFF3F2867, 00007FFDFF3F2994

Memory Dump Source

Source File: 00000001.00000002.1789715337.00007FFDFF3F1000.00000020.00000001.01000000.0000003C.sdmp, Offset: 00007FFDFF3F0000, based on PE: true

Associated: 00000001.00000002.1789684258.00007FFDFF3F0000.00000002.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789751805.00007FFDFF3F3000.00000002.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789778567.00007FFDFF3F4000.00000004.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789802581.00007FFDFF3F5000.00000002.00000001.01000000.0000003C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff3f0000_lz4wnSavmK.jbxd

Similarity

API ID: _wassert$memcpy
String ID: ((Nk==4) && (Nr==10)) || ((Nk==6) && (Nr==12)) || ((Nk==8) && (Nr==14))$(idx>=1) && (idx<=10)$src/AESNI.c$src/AESNI.c
API String ID: 4292997394-722309440
Opcode ID: d39dd8ff127fcd6812d8991013f514968d842da6ae2888197d778fac17dca971
Instruction ID: a059a413e424ebc6a5f55ea89ed1613c2d27f64f365b0b312f343935d54a9bc6
Opcode Fuzzy Hash: d39dd8ff127fcd6812d8991013f514968d842da6ae2888197d778fac17dca971
Instruction Fuzzy Hash: CB61D272F086C782EB24AB24E460AB97390FB95744F414331CA7D2B6D9EE7CE585C700

Function 00007FF77C631050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF77C6310CC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF77C631098
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF77C631108
fread, xrefs: 00007FF77C6311FD
malloc, xrefs: 00007FF77C63110F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF77C6311F6
fseek, xrefs: 00007FF77C6310D3

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: de8e61ec69997f11b469c92c7e882d5c70667b0ffac99a6e4ea54993eceeeb84
Instruction ID: 3df8b116d815d9678d17537c549c6dcb0a4c7630eb520bb13e888315c66f08a2
Opcode Fuzzy Hash: de8e61ec69997f11b469c92c7e882d5c70667b0ffac99a6e4ea54993eceeeb84
Instruction Fuzzy Hash: 27416263B3855241EB12FB12A8815BBE396BF8DB84FD44431ED4C87795DE3CE2458760

Function 00007FF77C638850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF77C633CBB), ref: 00007FF77C6388F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF77C633CBB), ref: 00007FF77C6388FA
CreateDirectoryW.KERNEL32(?,00000000,00007FF77C633CBB), ref: 00007FF77C63893C

Part of subcall function 00007FF77C638A20: GetEnvironmentVariableW.KERNEL32(00007FF77C63388E), ref: 00007FF77C638A57
Part of subcall function 00007FF77C638A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF77C638A79

Part of subcall function 00007FF77C6482A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6482C1

Part of subcall function 00007FF77C632810: MessageBoxW.USER32 ref: 00007FF77C6328EA

Strings

TMP, xrefs: 00007FF77C6388B2
TMP, xrefs: 00007FF77C63888C, 00007FF77C638993
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF77C63896E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF77C6388CC
_MEI%d, xrefs: 00007FF77C638902

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 6ea14b1c2d16789ddeaa0d8cc05df9935aa6d91fa7ad17376743f3d33dced37a
Instruction ID: 3e306fa1590a24d5078505c44ce94abca282e781c9ed829ea387d64cd84a1fc2
Opcode Fuzzy Hash: 6ea14b1c2d16789ddeaa0d8cc05df9935aa6d91fa7ad17376743f3d33dced37a
Instruction Fuzzy Hash: EE417313A3864245EB52BB25A9D51FB9292AF8CB80FD04132EE0DD66D6DD3CE6048320

Function 00007FFE01423BC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,00007FFE014235ED,?,?,?,?,00000000,?,?,?,00007FFE01426DB6), ref: 00007FFE01423C4E
ERR_set_debug.LIBCRYPTO-3(?,00007FFE014235ED,?,?,?,?,00000000,?,?,?,00007FFE01426DB6), ref: 00007FFE01423C66
ERR_new.LIBCRYPTO-3(?,00007FFE014235ED,?,?,?,?,00000000,?,?,?,00007FFE01426DB6), ref: 00007FFE01423CD6
ERR_set_debug.LIBCRYPTO-3(?,00007FFE014235ED,?,?,?,?,00000000,?,?,?,00007FFE01426DB6), ref: 00007FFE01423CEE
ERR_new.LIBCRYPTO-3(?,00007FFE014235ED,?,?,?,?,00000000,?,?,?,00007FFE01426DB6), ref: 00007FFE01423D1D
ERR_set_debug.LIBCRYPTO-3(?,00007FFE014235ED,?,?,?,?,00000000,?,?,?,00007FFE01426DB6), ref: 00007FFE01423D35

Strings

create_ticket_prequel, xrefs: 00007FFE01423C53, 00007FFE01423CDB, 00007FFE01423D22
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFE01423C5F, 00007FFE01423CE7, 00007FFE01423D2E

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$create_ticket_prequel
API String ID: 193678381-2110699330
Opcode ID: 7a1e1a942697126a7e2585fbb89ef6e620470843cd1160c90b97ff364b461a2b
Instruction ID: d2e44d8c0a625160f820829254c3595c5bc2ea41cd00c4d8008c7246f4c5dd58
Opcode Fuzzy Hash: 7a1e1a942697126a7e2585fbb89ef6e620470843cd1160c90b97ff364b461a2b
Instruction Fuzzy Hash: 97418561B1C58282F750DB22E8957BD2660FFA8BC4F944431DE0D8F6B2DE6CE582C702

Function 00007FFE0141DCC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,?,?,?,00007FFE01420555), ref: 00007FFE0141DDCB
BIO_ctrl.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE01420555), ref: 00007FFE0141DDF1
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE01420555), ref: 00007FFE0141DDFA
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFE01420555), ref: 00007FFE0141DE12

Strings

get_cert_verify_tbs_data, xrefs: 00007FFE0141DDFF
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFE0141DE0B
TLS 1.3, client CertificateVerify, xrefs: 00007FFE0141DD39
TLS 1.3, server CertificateVerify, xrefs: 00007FFE0141DD61

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_ctrlR_newR_set_debugmemmove
String ID: ..\s\ssl\statem\statem_lib.c$TLS 1.3, client CertificateVerify$TLS 1.3, server CertificateVerify$get_cert_verify_tbs_data
API String ID: 2906031378-3760622993
Opcode ID: 2e2892616ab69ccc4a6a71a34afaa7bfabbfc2e0ebdf9cccde18593cb9e65c89
Instruction ID: d650455e7eca64dee62b94f22849ffd611827a3aa1ad47eac47412dcd2ddffeb
Opcode Fuzzy Hash: 2e2892616ab69ccc4a6a71a34afaa7bfabbfc2e0ebdf9cccde18593cb9e65c89
Instruction Fuzzy Hash: 1F41A362E08B8292E750CF64D4846BD6760FBA5B84F849132DB8C8B6B1DF3DE596C700

Function 00007FFE013B1622 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE013D3D20
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFE013D3D35
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE013D3D4E

Strings

SSL_set_cipher_list, xrefs: 00007FFE013D3D75
..\s\ssl\ssl_lib.c, xrefs: 00007FFE013D3D81

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: L_sk_num$L_sk_value
String ID: ..\s\ssl\ssl_lib.c$SSL_set_cipher_list
API String ID: 1603723057-1252523853
Opcode ID: 6abc975f689e2e66eb2796b33e0a5bbe0f0a88f60fffab79847ed839543e937e
Instruction ID: 751944a5a5da9ba463ff5b575b8f5ca54b5fbc2cba3ac00d190b259d893dc6be
Opcode Fuzzy Hash: 6abc975f689e2e66eb2796b33e0a5bbe0f0a88f60fffab79847ed839543e937e
Instruction Fuzzy Hash: 5121C572B1969182E750AB19F8902ED63A0FF94B84F990035EB4D4B7F2DF3CD9428B05

Function 00007FF77C63EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF77C63EAD5

Part of subcall function 00007FF77C63FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF77C63FA6F
Part of subcall function 00007FF77C63FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF77C63FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF77C63EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF77C63EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF77C63EF08

Strings

csm, xrefs: 00007FF77C63EBD0
csm, xrefs: 00007FF77C63EB56
csm, xrefs: 00007FF77C63EAEF

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: 59c1283f52e92d9e6681d8530fb94a9bdf7b45f029f3b5ed55d8dae20ab1e420
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: 13D1A177A3874186EB22EB25D4803AEB7A1FB48798F400135EE4D97B95DF38E451C720

Function 00007FF77C64ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF77C64F11A,?,?,0000023D1BF99B38,00007FF77C64ADC3,?,?,?,00007FF77C64ACBA,?,?,?,00007FF77C645FAE), ref: 00007FF77C64EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF77C64F11A,?,?,0000023D1BF99B38,00007FF77C64ADC3,?,?,?,00007FF77C64ACBA,?,?,?,00007FF77C645FAE), ref: 00007FF77C64EF08

Strings

api-ms-, xrefs: 00007FF77C64EE46
ext-ms-, xrefs: 00007FF77C64EE59

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: 668d798f9973a83621ca0681d29cfe874e03cdac1b470e88bd5391cf6b6c1c10
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: A741C427B39A1282EB17EB169884577F292BF4DB90FC84535DD1DDB384EE3CE6058220

Function 00007FF77C632C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C633706,?,00007FF77C633804), ref: 00007FF77C632C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF77C633706,?,00007FF77C633804), ref: 00007FF77C632D63
MessageBoxW.USER32 ref: 00007FF77C632D99

Strings

<FormatMessageW failed.>, xrefs: 00007FF77C632D70
%ls: , xrefs: 00007FF77C632D22
[PYI-%d:ERROR] , xrefs: 00007FF77C632CA6
Error, xrefs: 00007FF77C632D8C

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: f5708d039780d66c9dc51e505d35a1713d04afc18e947e0aaf9092ff12246f05
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 0E31B723728A4142E722BB15B8802ABA797BF8C798F800135EF4DD7759DE3CD546C710

Function 00007FFE013F9FB0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013F9FFA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FA012
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FA05F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013FA077
ERR_new.LIBCRYPTO-3 ref: 00007FFE013FA0B9

Strings

..\s\ssl\record\ssl3_record.c, xrefs: 00007FFE013FA00B, 00007FFE013FA070
early_data_count_ok, xrefs: 00007FFE013F9FFF, 00007FFE013FA069

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ..\s\ssl\record\ssl3_record.c$early_data_count_ok
API String ID: 476316267-4150192623
Opcode ID: b827b963adc07f8f303b48ad48113d6b4a87dacd12daa6861e4b218454082955
Instruction ID: 451b6ab8d2b0022fee1b5bfa0b217217686187812c58c494e152ec2c7676f013
Opcode Fuzzy Hash: b827b963adc07f8f303b48ad48113d6b4a87dacd12daa6861e4b218454082955
Instruction Fuzzy Hash: 3F31B132B1858287EB94EB25E4907BD3391EF94784F564039EA0D4F6B1DE3CE9858700

Function 00007FFE013B2392 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01405D03
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01405D1B
ERR_new.LIBCRYPTO-3 ref: 00007FFE01405D56
ERR_new.LIBCRYPTO-3 ref: 00007FFE01405D62
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01405D7A

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFE01405D14, 00007FFE01405D73
tls_parse_stoc_maxfragmentlen, xrefs: 00007FFE01405D0D, 00007FFE01405D67

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_parse_stoc_maxfragmentlen
API String ID: 476316267-2494698823
Opcode ID: 5cc89016b1e3d1426edd97c28c221bfa48da024f2491fdafb2574cd8dfd73b7c
Instruction ID: 93cb37ef7a0785028545ebead9510647f3caa81d4bb58ca02702918e19795fcc
Opcode Fuzzy Hash: 5cc89016b1e3d1426edd97c28c221bfa48da024f2491fdafb2574cd8dfd73b7c
Instruction Fuzzy Hash: 221184B1A1958292F751A761E8912FD2751EF90740F884432DA0D0F7B2EE2C9AD38710

Function 00007FFE013D5D10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE013D5D33
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFE013D5D45
ERR_new.LIBCRYPTO-3 ref: 00007FFE013D5D5D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D5D75
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D5D86

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013D5D6E
ct_strict, xrefs: 00007FFE013D5D62

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: L_sk_numL_sk_valueR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ct_strict
API String ID: 2392307641-4060112342
Opcode ID: 2d0cd886799db58d7b469beb0f1b7e831c794a4a918643cc0e041093f625f1ce
Instruction ID: 0230ad866732d723d0395fc3531eb149095d4ec4051934aabb30beb16dd0e58b
Opcode Fuzzy Hash: 2d0cd886799db58d7b469beb0f1b7e831c794a4a918643cc0e041093f625f1ce
Instruction Fuzzy Hash: C201D221F1854242F794EB25B8955AD5261EF847C0F954031FA5D8FBB6EE2CE8828711

Function 00007FFE013B1A5A Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

d2i_PrivateKey_ex.LIBCRYPTO-3 ref: 00007FFE013D9C66
ERR_new.LIBCRYPTO-3 ref: 00007FFE013D9C73
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D9C8B
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D9C9B
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFE013D9CC1

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFE013D9C84
SSL_CTX_use_PrivateKey_ASN1, xrefs: 00007FFE013D9C78

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: Key_exPrivateR_newR_set_debugR_set_errorY_freed2i_
String ID: ..\s\ssl\ssl_rsa.c$SSL_CTX_use_PrivateKey_ASN1
API String ID: 3030233885-1502814970
Opcode ID: 1dfd130f0def66e16577bc01286c0ef96469c4fa15f0ffcff0f1a38f63df8103
Instruction ID: 018b9d418e2297657f9249d051e435b7d3be31948d869b45d55ad7ca14d5fdc5
Opcode Fuzzy Hash: 1dfd130f0def66e16577bc01286c0ef96469c4fa15f0ffcff0f1a38f63df8103
Instruction Fuzzy Hash: 1B019B62B18A4181EB40EB55F9912ADA3A1FF9C7C4F950031EA4C4BBB6EE3CD4918700

Function 00007FFE013B58C0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

BIO_get_data.LIBCRYPTO-3 ref: 00007FFE013B590D
BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFE013B5920
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFE013B5965
BIO_set_retry_reason.LIBCRYPTO-3 ref: 00007FFE013B5A05

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_clear_flagsO_get_dataO_set_flagsO_set_retry_reason
String ID:
API String ID: 3836630899-0
Opcode ID: afe86e6ad3a5db392f23f95dfd19305c9bfff0712bd97fbf8711193d70f6c69c
Instruction ID: c64d66cc5be12252dd1602f0c54fbdcb687afdef50be7a1b789b24797ac5c02e
Opcode Fuzzy Hash: afe86e6ad3a5db392f23f95dfd19305c9bfff0712bd97fbf8711193d70f6c69c
Instruction Fuzzy Hash: B941E832E1824242E755AB22A5D127E7751FF41BD4F954031DF0D5FBA6EE3CE8828741

Function 00007FFE013B1573 Relevance: 12.1, APIs: 8, Instructions: 104COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE013D2023
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE013D2033
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE013D2054
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFE013D2065
OPENSSL_sk_find.LIBCRYPTO-3 ref: 00007FFE013D2073
OPENSSL_strnlen.LIBCRYPTO-3 ref: 00007FFE013D2083
memmove.VCRUNTIME140 ref: 00007FFE013D209D
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFE013D20BB

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: L_sk_num$L_sk_findL_sk_valueL_strnlenmemmove
String ID:
API String ID: 779716121-0
Opcode ID: 73a4380347fbe8faae797dd1d4027ad625038518a7ebb6a41c76bab9fe3d05f5
Instruction ID: 76f994b742b7f94436ebeef2f96616f7c5ab338683bf22f6b9dfff86f4963170
Opcode Fuzzy Hash: 73a4380347fbe8faae797dd1d4027ad625038518a7ebb6a41c76bab9fe3d05f5
Instruction Fuzzy Hash: C8311022B0968245EB10AA26BE5123F6791BF51BD4F4A8031EE8D8B7B5DF3CE481C300

Function 00007FFE0141BD60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFE0141BE37

Part of subcall function 00007FFE013B1299: EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FFE0141A9C6
Part of subcall function 00007FFE013B1299: EVP_CIPHER_get_flags.LIBCRYPTO-3 ref: 00007FFE0141A9CE
Part of subcall function 00007FFE013B1299: EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFE0141A9E0
Part of subcall function 00007FFE013B1299: EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFE0141A9E8
Part of subcall function 00007FFE013B1299: EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FFE0141AA01
Part of subcall function 00007FFE013B1299: EVP_CIPHER_get_mode.LIBCRYPTO-3 ref: 00007FFE0141AA09
Part of subcall function 00007FFE013B1299: EVP_CIPHER_CTX_get_block_size.LIBCRYPTO-3 ref: 00007FFE0141AA1A
Part of subcall function 00007FFE013B1299: BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE0141AA9A

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE0141BF67
ERR_new.LIBCRYPTO-3 ref: 00007FFE0141BFB3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0141BFCB

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FFE0141BFC4
dtls1_retransmit_message, xrefs: 00007FFE0141BFB8

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_ctrlX_get0_cipher$D_get_sizeR_get_flagsR_get_modeR_newR_set_debugX_get0_mdX_get_block_sizememmove
String ID: ..\s\ssl\statem\statem_dtls.c$dtls1_retransmit_message
API String ID: 2736015689-3409696843
Opcode ID: 2f7cf66fc46072f6138dfe70ca00b8ca3d4b9b2d2993464c1367226c181939db
Instruction ID: c24e4dddcbc880726e5a816bea65086aae03a554e1decf963ef0c88191842287
Opcode Fuzzy Hash: 2f7cf66fc46072f6138dfe70ca00b8ca3d4b9b2d2993464c1367226c181939db
Instruction Fuzzy Hash: 12619A32604B8492E794DB26E490AAE77A8FB88B94F414136EF9C47761DF3CD4A1C740

Function 00007FFDFAAF16F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFDFAAF17C8
PyUnicode_FromString.PYTHON312 ref: 00007FFDFAAF182C
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAAF38EA

Strings

argument, xrefs: 00007FFDFAAF38DC
category, xrefs: 00007FFDFAAF38E3
a unicode character, xrefs: 00007FFDFAAF38D5

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: a unicode character$argument$category
API String ID: 1318908108-2068800536
Opcode ID: 75ddb3696b46489ca6549d465876fca1f165cfd7b87c949410c65a543f1dc5fb
Instruction ID: 613a0fc4c705bacdc42c8b6e3f2b4a005c90ca19752add28095c2721f5c9f1ce
Opcode Fuzzy Hash: 75ddb3696b46489ca6549d465876fca1f165cfd7b87c949410c65a543f1dc5fb
Instruction Fuzzy Hash: 0C51C462B18BC681EB5D8B05D470AB873A1EF94B84F440075DAAF877D8DF2CE85AD350

Function 00007FFDFAAF1000 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFDFAAF10D3
PyUnicode_FromString.PYTHON312 ref: 00007FFDFAAF10F8
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAAF35B0

Strings

bidirectional, xrefs: 00007FFDFAAF35A9
argument, xrefs: 00007FFDFAAF35A2
a unicode character, xrefs: 00007FFDFAAF359B

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: a unicode character$argument$bidirectional
API String ID: 1318908108-2110215792
Opcode ID: 6f7a0223ee0090118d1ffdd6d95c782b73d4ddee4bbf01c7b704a6e76ba36895
Instruction ID: c434d39723861dbdfe3860f0a362bdd45587757269ee470ed0a4f48acc8c9a59
Opcode Fuzzy Hash: 6f7a0223ee0090118d1ffdd6d95c782b73d4ddee4bbf01c7b704a6e76ba36895
Instruction Fuzzy Hash: 9741B162B18BC281EF5D8B15C475B7933A1EF44790F841079DA6F876C8CF2DE89A8354

Function 00007FFE013B1014 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01407C41
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01407C59
ERR_new.LIBCRYPTO-3 ref: 00007FFE01407CDE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01407CF6

Strings

..\s\ssl\statem\extensions_cust.c, xrefs: 00007FFE01407C52, 00007FFE01407CEF
custom_ext_parse, xrefs: 00007FFE01407C46, 00007FFE01407CE3

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_cust.c$custom_ext_parse
API String ID: 193678381-2402109875
Opcode ID: 2157215991b731237227d426bc36b46e76949bafcfdcd6ddbc723cecc6a7bf4f
Instruction ID: 93b006c32ae7d98e76ef93f261c1cc7367de4001a04e688fbea8319f10ac7c1d
Opcode Fuzzy Hash: 2157215991b731237227d426bc36b46e76949bafcfdcd6ddbc723cecc6a7bf4f
Instruction Fuzzy Hash: C241D331A1D64282E7619F66E4406BD33A1FB84B85F184039DE8D4BBB4DE3CEC51C741

Function 00007FF77C63DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF77C63DFEA,?,?,?,00007FF77C63DCDC,?,?,?,00007FF77C63D8D9), ref: 00007FF77C63DDBD
GetLastError.KERNEL32(?,?,?,00007FF77C63DFEA,?,?,?,00007FF77C63DCDC,?,?,?,00007FF77C63D8D9), ref: 00007FF77C63DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF77C63DFEA,?,?,?,00007FF77C63DCDC,?,?,?,00007FF77C63D8D9), ref: 00007FF77C63DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF77C63DFEA,?,?,?,00007FF77C63DCDC,?,?,?,00007FF77C63D8D9), ref: 00007FF77C63DE63
GetProcAddress.KERNEL32(?,?,?,00007FF77C63DFEA,?,?,?,00007FF77C63DCDC,?,?,?,00007FF77C63D8D9), ref: 00007FF77C63DE6F

Strings

api-ms-, xrefs: 00007FF77C63DDDD

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: 7c1395ff52bb0383653c103124299ef6361d0c6233014f41a5557aa0bc79997d
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: B0317022B3A64291EF13BB02A880576A795FF5CBA4F994535EE1D87384EF3CE4458324

Function 00007FFE013B2207 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFE01411C8C
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFE01411C99

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFE01412080
ossl_statem_client_read_transition, xrefs: 00007FFE01412074

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: ..\s\ssl\statem\statem_clnt.c$ossl_statem_client_read_transition
API String ID: 3946675294-211585089
Opcode ID: 8ba2f46f0b448aa90e311d12c01b0859db567b14347f702688f6da89933cb1a1
Instruction ID: 2ae0c823389f6aad37d0208c2c218086557bcb823b43b4792c02cfc4f025daab
Opcode Fuzzy Hash: 8ba2f46f0b448aa90e311d12c01b0859db567b14347f702688f6da89933cb1a1
Instruction Fuzzy Hash: 91318172B0854286EB54DB25E4D47BC2792EB88B84F594431EB0D8F7B6DE2DE5C28700

Function 00007FFE013B1E1B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE0142701A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01427032
ERR_new.LIBCRYPTO-3 ref: 00007FFE01427090
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE014270A8

Strings

tls_construct_server_certificate, xrefs: 00007FFE0142701F, 00007FFE01427095
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFE0142702B, 00007FFE014270A1

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$tls_construct_server_certificate
API String ID: 193678381-3740638300
Opcode ID: e128bf10da1aeeeade1038166650ca6bd724d7b72962b563d6b415c8766d8291
Instruction ID: 6edb640dc023d005bdc60548d5be920c9c568d56621b9eecde8b827e17e5cf1c
Opcode Fuzzy Hash: e128bf10da1aeeeade1038166650ca6bd724d7b72962b563d6b415c8766d8291
Instruction Fuzzy Hash: 65219631F1C68282E754D726E8906AD6750EFA4BC4F884035EE4D8BBB6DE2CE5C6C701

Function 00007FFE013B24CD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01423ED7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01423EEF
ERR_new.LIBCRYPTO-3 ref: 00007FFE01423F0D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01423F25

Strings

dtls_construct_hello_verify_request, xrefs: 00007FFE01423EDC, 00007FFE01423F12
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFE01423EE8, 00007FFE01423F1E

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$dtls_construct_hello_verify_request
API String ID: 193678381-1802759638
Opcode ID: bc86a8f039aea719a0fc61957b91765e84f4fab7c35ae9e5c11263e1b859cb23
Instruction ID: 422de3a6d4978066d0f93a873c29d14d0efdf01375a3674f8ed7caa0d6b55390
Opcode Fuzzy Hash: bc86a8f039aea719a0fc61957b91765e84f4fab7c35ae9e5c11263e1b859cb23
Instruction Fuzzy Hash: 0A317F31B1868281E7509B55E851BFE2665EF98BC4F880036EB4D4BBB6DF2DE5818701

Function 00007FF77C632A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF77C63351A,?,00000000,00007FF77C633F23), ref: 00007FF77C632AA0

Strings

0, xrefs: 00007FF77C632B16
Warning [ANSI Fallback], xrefs: 00007FF77C632B0F
WARNING, xrefs: 00007FF77C632AAF
Warning, xrefs: 00007FF77C632B1E
[PYI-%d:%s] , xrefs: 00007FF77C632AA8

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 0c7eaf926f917a2dc6b1bdf557cbfa568e0ea31aca9bcd9739f1c98dfa5c6bc4
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: BC217F73B38B8192E722EB51B8817E7A395BB88784F800132FE8C93659DF3CD2458650

Function 00007FF77C638760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF77C638780
OpenProcessToken.ADVAPI32 ref: 00007FF77C638793
GetTokenInformation.ADVAPI32 ref: 00007FF77C6387B8
GetLastError.KERNEL32 ref: 00007FF77C6387C2
GetTokenInformation.ADVAPI32 ref: 00007FF77C638802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF77C63881E
CloseHandle.KERNEL32 ref: 00007FF77C638836

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1e3bf3a8b1345e2c0c0bdd6ff4e06add0bb9355989cc78c5a669156b3459c754
Instruction ID: 868ca856f451a2f1b2052b18092ee8553e4219f53cd6ed36ec3068dd8b33fd62
Opcode Fuzzy Hash: 1e3bf3a8b1345e2c0c0bdd6ff4e06add0bb9355989cc78c5a669156b3459c754
Instruction Fuzzy Hash: 38214422B2864241EB51AB55B49427BE7A2EBCDBA0F900235EA6D836E4DE7CD4448710

Function 00007FF77C64B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF77C64B1CF
FlsGetValue.KERNEL32 ref: 00007FF77C64B1E4
FlsSetValue.KERNEL32 ref: 00007FF77C64B205
FlsSetValue.KERNEL32 ref: 00007FF77C64B232
FlsSetValue.KERNEL32 ref: 00007FF77C64B243
FlsSetValue.KERNEL32 ref: 00007FF77C64B254
SetLastError.KERNEL32 ref: 00007FF77C64B26F

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 64d992c46ee3b7395fe78fb810fe312dfe396e54660f00f57cdb80144ae96788
Instruction ID: 10ad2220ca5c5e41b241893cb13ff3311d6c512e72b1bfdc0d6b04a16c043729
Opcode Fuzzy Hash: 64d992c46ee3b7395fe78fb810fe312dfe396e54660f00f57cdb80144ae96788
Instruction Fuzzy Hash: AF213626A3C60241FB5A77A196E113FF1535F8CBA0F944634DD3E8AAD6DE2CA7018321

Function 00007FF77C657DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF77C657E0D
GetLastError.KERNEL32 ref: 00007FF77C657E19
CloseHandle.KERNEL32 ref: 00007FF77C657E31
CreateFileW.KERNEL32 ref: 00007FF77C657E5C
WriteConsoleW.KERNEL32 ref: 00007FF77C657E7B

Strings

CONOUT$, xrefs: 00007FF77C657E3D

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: f73039f58a69863f39feb8ae68b61f6f28157fd86224e2d3a971d63c839ef94b
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: 3A117222738B4186E351AB52B89433AB3A1BB8CBE4F900234DE5DC7794DF3CD9048750

Function 00007FFDFAAF1150 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFDFAAF3607
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAAF363A

Part of subcall function 00007FFDFAAF11B0: PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFAAF11E2
Part of subcall function 00007FFDFAAF11B0: PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFDFAAF11FA
Part of subcall function 00007FFDFAAF11B0: PyType_IsSubtype.PYTHON312 ref: 00007FFDFAAF121D

Strings

argument 2, xrefs: 00007FFDFAAF3625
argument 1, xrefs: 00007FFDFAAF3619
str, xrefs: 00007FFDFAAF362C
normalize, xrefs: 00007FFDFAAF35FA, 00007FFDFAAF3633

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Arg_CompareStringUnicode_With$ArgumentCheckPositionalSubtypeType_
String ID: argument 1$argument 2$normalize$str
API String ID: 4101545800-1320425463
Opcode ID: 2dbf24b9019d36270aeee854f5eb720b9aec5d3fd397e623ab08701816bde558
Instruction ID: 6eab9f815c14655d0df698b7e586e9264d11c8b57386f924556d96b004805dca
Opcode Fuzzy Hash: 2dbf24b9019d36270aeee854f5eb720b9aec5d3fd397e623ab08701816bde558
Instruction Fuzzy Hash: DC117360B08BC290EB5C8B55E8A4AB57360AF04FC4F898075D93D0B3D8DF2CD54AC310

Function 00007FFE013B1AAA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

EC_KEY_get0_group.LIBCRYPTO-3 ref: 00007FFE013F1ADC
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F1AE6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F1AFE
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013F1B0F

Strings

..\s\ssl\tls_depr.c, xrefs: 00007FFE013F1AF7
ssl_set_tmp_ecdh_groups, xrefs: 00007FFE013F1AEB

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorY_get0_group
String ID: ..\s\ssl\tls_depr.c$ssl_set_tmp_ecdh_groups
API String ID: 2690379533-3926364423
Opcode ID: 45eab686c58ca8c81eac5e29737392f2cac606e5fed72d4ccbde05fd96734503
Instruction ID: cf947b9a5a067997dcd0a04dfbc61c24723c4f8a6b809a61205620ffdd4d8af8
Opcode Fuzzy Hash: 45eab686c58ca8c81eac5e29737392f2cac606e5fed72d4ccbde05fd96734503
Instruction Fuzzy Hash: E1018F21F1828281EB90E765F9516BD5261EF987C4F950031EA0D8BBF6EE2CE4818701

Function 00007FFDFAAF4764 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFDFAAF4790
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAAF47C5

Strings

is_normalized, xrefs: 00007FFDFAAF4783, 00007FFDFAAF47BE
argument 2, xrefs: 00007FFDFAAF47E6
argument 1, xrefs: 00007FFDFAAF47B0
str, xrefs: 00007FFDFAAF47B7

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: argument 1$argument 2$is_normalized$str
API String ID: 3876575403-184702317
Opcode ID: a144f24e6de5b7cccd567b51e7b194ed070cb538066fb7292dbf1d4aae94f326
Instruction ID: ce7f50a2e0c28dd7dca81295b74ce15a10c5df745183d8072163ecf08b27be1a
Opcode Fuzzy Hash: a144f24e6de5b7cccd567b51e7b194ed070cb538066fb7292dbf1d4aae94f326
Instruction Fuzzy Hash: 0E015B64B087C695EB5C8B56E8B0EB53360AB05FC4F9880B2D92D076DCDE2CD58AC300

Function 00007FFE013B116D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE0140BC49
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140BC61
ERR_new.LIBCRYPTO-3 ref: 00007FFE0140BC8B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE0140BCA3

Strings

tls_parse_ctos_early_data, xrefs: 00007FFE0140BC4E, 00007FFE0140BC90
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFE0140BC5A, 00007FFE0140BC9C

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_early_data
API String ID: 193678381-408386505
Opcode ID: d44309eef682da9d3054615f906b799589b390c34b3700588ac08bad1ac7d1b8
Instruction ID: f52b5050db0531d2afac5adf2f856223a055a06928b3bf141e6a778ca6f35146
Opcode Fuzzy Hash: d44309eef682da9d3054615f906b799589b390c34b3700588ac08bad1ac7d1b8
Instruction Fuzzy Hash: AE018C75E2A542A3F351A7A1E8853FC2251EF94344FD80039D50C8E6F2EE3CAAC28605

Function 00007FFE013F1AB4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

EC_KEY_get0_group.LIBCRYPTO-3 ref: 00007FFE013F1ADC
ERR_new.LIBCRYPTO-3 ref: 00007FFE013F1AE6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013F1AFE
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013F1B0F

Strings

..\s\ssl\tls_depr.c, xrefs: 00007FFE013F1AF7
ssl_set_tmp_ecdh_groups, xrefs: 00007FFE013F1AEB

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorY_get0_group
String ID: ..\s\ssl\tls_depr.c$ssl_set_tmp_ecdh_groups
API String ID: 2690379533-3926364423
Opcode ID: 291af4b9b06ec7a0131e858965ad59492d26e6a0a040c0f7e202aca72186f2bc
Instruction ID: 7958d93e95bba07faadc6054011941074410533967633c24c1375bee36827eea
Opcode Fuzzy Hash: 291af4b9b06ec7a0131e858965ad59492d26e6a0a040c0f7e202aca72186f2bc
Instruction Fuzzy Hash: 2FF08225F2818652E794A3A0E8526BD5252DF98384FD54431EA0C8BFF7EE3CE8964643

Function 00007FFDFAC4BBA4 Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 354COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAC4BC24

Strings

statement aborts at %d: [%s] %s, xrefs: 00007FFDFAC5005F
cannot release savepoint - SQL statements in progress, xrefs: 00007FFDFAC4FADF
no such savepoint: %s, xrefs: 00007FFDFAC4BCA4
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFDFAC4FA92, 00007FFDFAC4FDF0
cannot open savepoint - SQL statements in progress, xrefs: 00007FFDFAC4FABE

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memcpy
String ID: 831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$cannot open savepoint - SQL statements in progress$cannot release savepoint - SQL statements in progress$no such savepoint: %s$statement aborts at %d: [%s] %s
API String ID: 3510742995-2526444651
Opcode ID: c9d744cff9dc738ede1e2a386e920d6a7cb1c7740c9bf092cb904dc52b4c502a
Instruction ID: a2562b6fe83c2dfb98b8ac3ea86735798abd4f7ac207b2992dbf28c43bb55bb9
Opcode Fuzzy Hash: c9d744cff9dc738ede1e2a386e920d6a7cb1c7740c9bf092cb904dc52b4c502a
Instruction Fuzzy Hash: 6AF1DD3AB0869785EB68CF1AD064A7E6BA4FB85B84F010071DE6D577D9CE3CE941CB40

Function 00007FFDFAC73430 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 330COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAC7357B
memcpy.VCRUNTIME140 ref: 00007FFDFAC735C7
memcpy.VCRUNTIME140 ref: 00007FFDFAC7383C

Strings

unknown column "%s" in foreign key definition, xrefs: 00007FFDFAC737CC
foreign key on %s should reference only one column of table %T, xrefs: 00007FFDFAC734B5
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FFDFAC734DE

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memcpy$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 438689982-272990098
Opcode ID: d33b407a10e7d0ad13c26d0ca43705fecfafde5626fadbf1de958564b7d48643
Instruction ID: 5bf8cd7d9397ab7af062f2847d2ea43ea38f9d452867bafd86f250d4b5409976
Opcode Fuzzy Hash: d33b407a10e7d0ad13c26d0ca43705fecfafde5626fadbf1de958564b7d48643
Instruction Fuzzy Hash: E5D1F26AB09B8682EB698B15A464EBD3BA1FB44BC4F4441B2DE6D077C9DF3CE441C300

Function 00007FFDFAC46B10 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 278COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAC46F2D

Strings

API called with finalized prepared statement, xrefs: 00007FFDFAC46B41
API called with NULL prepared statement, xrefs: 00007FFDFAC46B2B
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFDFAC46B60
misuse, xrefs: 00007FFDFAC46B6D
%s at line %d of [%.10s], xrefs: 00007FFDFAC46B79

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$API called with NULL prepared statement$API called with finalized prepared statement$misuse
API String ID: 3510742995-774319783
Opcode ID: c1f2e72d02041f634680d4dfe94196d23bd266405e708ce222b3484ffe9b10a2
Instruction ID: 7c57ebc0cdebe62e58d14cbf00e2da63269608fe39a639acdfb9066a43d6b9bb
Opcode Fuzzy Hash: c1f2e72d02041f634680d4dfe94196d23bd266405e708ce222b3484ffe9b10a2
Instruction Fuzzy Hash: 73E15126F09BC681E7158F28D5147BC6360FBA9B48F149275DFAC1769AEF38E2D58300

Function 00007FF77C638560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF77C639216), ref: 00007FF77C638592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF77C639216), ref: 00007FF77C6385E9

Part of subcall function 00007FF77C639400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF77C6345E4,00000000,00007FF77C631985), ref: 00007FF77C639439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF77C639216), ref: 00007FF77C638678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF77C639216), ref: 00007FF77C6386E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF77C639216), ref: 00007FF77C6386F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF77C639216), ref: 00007FF77C63870A

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b2770b171440e78660be4c91fda42c27049aa369c6710ced6bdf6821ec2ad01d
Instruction ID: 28527531bd5f85a04fb5933b420b89bcca8cf4e0eab7c35c7a94e4ab62da60cb
Opcode Fuzzy Hash: b2770b171440e78660be4c91fda42c27049aa369c6710ced6bdf6821ec2ad01d
Instruction Fuzzy Hash: FB419363B3868241EB71AB11A5846ABA3A6FF8CBD4F840136DF4D97785DE3CD501C720

Function 00007FFDFF3F1D30 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFF3F1D99
_aligned_malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFF3F1E06
_aligned_malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFF3F1E22
_aligned_free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFF3F1E5E
_aligned_free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFF3F1E6D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDFF3F1E76

Memory Dump Source

Source File: 00000001.00000002.1789715337.00007FFDFF3F1000.00000020.00000001.01000000.0000003C.sdmp, Offset: 00007FFDFF3F0000, based on PE: true

Associated: 00000001.00000002.1789684258.00007FFDFF3F0000.00000002.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789751805.00007FFDFF3F3000.00000002.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789778567.00007FFDFF3F4000.00000004.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789802581.00007FFDFF3F5000.00000002.00000001.01000000.0000003C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff3f0000_lz4wnSavmK.jbxd

Similarity

API ID: _aligned_free_aligned_malloc$callocfree
String ID:
API String ID: 2511558924-0
Opcode ID: 8fb2105fd7c39bf321232f7441f6f1b7ebcf620c9448f78960a77339e4ca462d
Instruction ID: 9c9735ede31ce1d41363b41e322f2e1266c6350b663233bf94348b6b1f177b40
Opcode Fuzzy Hash: 8fb2105fd7c39bf321232f7441f6f1b7ebcf620c9448f78960a77339e4ca462d
Instruction Fuzzy Hash: 35414F66B09B8283EB19EB41E46063963E0FF54B90F484631DE6E4B7D8EF7CE8558300

Function 00007FFE013D7B22 Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

ERR_set_mark.LIBCRYPTO-3 ref: 00007FFE013D7B3C
OBJ_nid2sn.LIBCRYPTO-3 ref: 00007FFE013D7B43
EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FFE013D7B51
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFE013D7B59
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FFE013D7BA6
EVP_MD_free.LIBCRYPTO-3 ref: 00007FFE013D7BB3

Part of subcall function 00007FFE013B2072: ENGINE_finish.LIBCRYPTO-3 ref: 00007FFE013F1CD2

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: D_fetchD_freeD_get0_providerE_finishJ_nid2snR_pop_to_markR_set_mark
String ID:
API String ID: 3757542325-0
Opcode ID: 829558ffedcbe436977f3bb2c65a52e7f7dbc3a586ea058e1ae2543141a63a85
Instruction ID: b3c7f5caaa927b40dbb65f95c7f584d83229c8052e0fa499a4a87c997d4ac060
Opcode Fuzzy Hash: 829558ffedcbe436977f3bb2c65a52e7f7dbc3a586ea058e1ae2543141a63a85
Instruction Fuzzy Hash: D5F04911F0A20206FF5977E268462BC61915FAEB94F891434EE4E5FBF3ED2CE8810351

Function 00007FF77C6390E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77C638760: GetCurrentProcess.KERNEL32 ref: 00007FF77C638780
Part of subcall function 00007FF77C638760: OpenProcessToken.ADVAPI32 ref: 00007FF77C638793
Part of subcall function 00007FF77C638760: GetTokenInformation.ADVAPI32 ref: 00007FF77C6387B8
Part of subcall function 00007FF77C638760: GetLastError.KERNEL32 ref: 00007FF77C6387C2
Part of subcall function 00007FF77C638760: GetTokenInformation.ADVAPI32 ref: 00007FF77C638802
Part of subcall function 00007FF77C638760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF77C63881E
Part of subcall function 00007FF77C638760: CloseHandle.KERNEL32 ref: 00007FF77C638836

LocalFree.KERNEL32(?,00007FF77C633C55), ref: 00007FF77C63916C
LocalFree.KERNEL32(?,00007FF77C633C55), ref: 00007FF77C639175

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF77C639142
S-1-3-4, xrefs: 00007FF77C639121
D:(A;;FA;;;%s), xrefs: 00007FF77C639157
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF77C639183

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction ID: c4cbfdd55ff3bf00d0f1a6a12ec3965102984bd89673b3ed4d265df4b183e318
Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction Fuzzy Hash: 3F211C23A38A4292E752BB10E5952EBA362FF8C780FD44035EA4D93796DF3CD9458760

Function 00007FFE013B16EA Relevance: 9.1, APIs: 6, Instructions: 63COMMON

Download Yara Rule

APIs

BIO_next.LIBCRYPTO-3 ref: 00007FFE013D3B70
BIO_up_ref.LIBCRYPTO-3 ref: 00007FFE013D3B8D
BIO_next.LIBCRYPTO-3 ref: 00007FFE013D3BA1
BIO_next.LIBCRYPTO-3 ref: 00007FFE013D3BBA
BIO_free_all.LIBCRYPTO-3 ref: 00007FFE013D3BCE
BIO_free_all.LIBCRYPTO-3 ref: 00007FFE013D3BEB

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_next$O_free_all$O_up_ref
String ID:
API String ID: 1216991848-0
Opcode ID: 3d962040b3249b589bf928f976abfb59706b636e2240d84bc5d5540052971784
Instruction ID: c237bf62382420dd58db2f18f5d77faf439236d2cd8670e3388392353c067b1d
Opcode Fuzzy Hash: 3d962040b3249b589bf928f976abfb59706b636e2240d84bc5d5540052971784
Instruction Fuzzy Hash: FA217FA1F09A0181EF689B65E89117C6360FF54FD4F454432EA8E0FBB9DE6CEC918312

Function 00007FF77C64B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA,?,?,?,?,00007FF77C6471FF), ref: 00007FF77C64B347
FlsSetValue.KERNEL32(?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA,?,?,?,?,00007FF77C6471FF), ref: 00007FF77C64B37D
FlsSetValue.KERNEL32(?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA,?,?,?,?,00007FF77C6471FF), ref: 00007FF77C64B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA,?,?,?,?,00007FF77C6471FF), ref: 00007FF77C64B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA,?,?,?,?,00007FF77C6471FF), ref: 00007FF77C64B3CC
SetLastError.KERNEL32(?,?,?,00007FF77C644F81,?,?,?,?,00007FF77C64A4FA,?,?,?,?,00007FF77C6471FF), ref: 00007FF77C64B3E7

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 508bc4e8de0e80a19cd6daf9ed8871fa40715e6eab000f8b832e18dd1cfec2a0
Instruction ID: 4a48cffebe2a61792af35a5b47116c16b9f54490f83de3da2488f702f71ec4a4
Opcode Fuzzy Hash: 508bc4e8de0e80a19cd6daf9ed8871fa40715e6eab000f8b832e18dd1cfec2a0
Instruction Fuzzy Hash: 5011F826A3CA4282F757776296D113BF1535F8C7A0B944634DA2ECA6D6DE2CA6018321

Function 00007FF77C632910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF77C631B6A), ref: 00007FF77C63295E

Strings

%s: %s, xrefs: 00007FF77C6329E8
[PYI-%d:ERROR] , xrefs: 00007FF77C632966
Error [ANSI Fallback], xrefs: 00007FF77C6329FF
Error, xrefs: 00007FF77C632A0E

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: 105a4c1febf8c39f9db4202fafb4e3b4aec72b4930ae7482d285028f2be29461
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: 6031A463B3868152E711A761B8816E7A296BF8C7D4F804132EE8DD3759EF3CD6468610

Function 00007FF77C632390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF77C6323C8
DialogBoxIndirectParamW.USER32 ref: 00007FF77C63248E
DeleteObject.GDI32 ref: 00007FF77C6324C1
DestroyIcon.USER32 ref: 00007FF77C6324D3

Strings

Unhandled exception in script, xrefs: 00007FF77C6323F8

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: dd10c28d74256616f4f20b34f0e4914686707bcd8d030bd0fddff274f11205b5
Instruction ID: 155bd523d157080d4b4985a794b797d2d676d0096d09bd0851a4e3d1e9af62d7
Opcode Fuzzy Hash: dd10c28d74256616f4f20b34f0e4914686707bcd8d030bd0fddff274f11205b5
Instruction Fuzzy Hash: C8313273A3968189EB21AB21F8951FAA351FF8C784F940135EA4D8BA5ADF3CD105C710

Function 00007FF77C632B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF77C63918F,?,00007FF77C633C55), ref: 00007FF77C632BA0
MessageBoxW.USER32 ref: 00007FF77C632C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF77C632BA8
WARNING, xrefs: 00007FF77C632BAF
Warning, xrefs: 00007FF77C632C1D

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: 711aac08c0f227ce4375ae82fe57499654687c397f11fe70bf9d22112f3eba4f
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: 1921D373728B4192E712AB14F4807ABB3A5EB8C784F804132EE8D97659DF3CD205C710

Function 00007FF77C632710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF77C631B99), ref: 00007FF77C632760

Strings

Error [ANSI Fallback], xrefs: 00007FF77C6327CF
Error, xrefs: 00007FF77C6327DE
ERROR, xrefs: 00007FF77C63276F
[PYI-%d:%s] , xrefs: 00007FF77C632768

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: 8e80d50c27a1b9f8f1a4797e9bf0ce19e3fa21fd2c4b938532dde35ea3163f2a
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: 17217F73B38B8192E721EB50B8817E7A3A5AB8C384F800132FE8D93659DF3CD2458750

Function 00007FFDFAAF4690 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAAF46C0
PyType_IsSubtype.PYTHON312 ref: 00007FFDFAAF4720

Strings

east_asian_width, xrefs: 00007FFDFAAF46B9
argument, xrefs: 00007FFDFAAF46B2
a unicode character, xrefs: 00007FFDFAAF46AB

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Arg_ArgumentSubtypeType_
String ID: a unicode character$argument$east_asian_width
API String ID: 1522575347-3913127203
Opcode ID: f8fe7d2390cefcda47379d0bc21b213a30bcd05f20e1989e4018474eb32f17be
Instruction ID: a81deaf7791ddda4e0716f827403acd90be438cd2b95ddc16d2825c6156bbd0b
Opcode Fuzzy Hash: f8fe7d2390cefcda47379d0bc21b213a30bcd05f20e1989e4018474eb32f17be
Instruction Fuzzy Hash: A3218E65F0CBC282EB5C8B51D460A7877A5EB45B80F8480B1D66E037ECDF2CE59A8740

Function 00007FFDFAAF4C58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFDFAAF4C84
_PyUnicode_ToNumeric.PYTHON312 ref: 00007FFDFAAF4CB7
PyErr_SetString.PYTHON312 ref: 00007FFDFAAF4CDF
PyFloat_FromDouble.PYTHON312 ref: 00007FFDFAAF4CF7

Strings

not a numeric character, xrefs: 00007FFDFAAF4CD5

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
String ID: not a numeric character
API String ID: 1034370217-2058156748
Opcode ID: 7ac3b2fdf3478d2374b08fe415c3a12b63c61252479e25d1cab849eb02e47f53
Instruction ID: 7c15745146ee458071dce6f4d503d070d0b53e3cde0e5359bd8e9fbd6489cda1
Opcode Fuzzy Hash: 7ac3b2fdf3478d2374b08fe415c3a12b63c61252479e25d1cab849eb02e47f53
Instruction Fuzzy Hash: 23214F21F08BC382EB5E8B26D43093877A4AF44B98F1591B0C93E566DCDF2CE44B8740

Function 00007FFE013EDD36 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FFE013EDD58
BIO_printf.LIBCRYPTO-3 ref: 00007FFE013EDD94

Strings

%s=0x%x (%s), xrefs: 00007FFE013EDD8D
cookie, xrefs: 00007FFE013EDDC3
server_version, xrefs: 00007FFE013EDD83

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s=0x%x (%s)$cookie$server_version
API String ID: 1860387303-2821402668
Opcode ID: 327565793ca1c70e8e8da8d0183750875db6904d42ff28b73fd3c334f791fb44
Instruction ID: d45ab0ee0e8725818103bb8ad41071dc06c7f6b9689a5ac2b4b9295ef471bf8f
Opcode Fuzzy Hash: 327565793ca1c70e8e8da8d0183750875db6904d42ff28b73fd3c334f791fb44
Instruction Fuzzy Hash: 9211C162B0C79142EB119B98E0040BAB392EF907A4F554232D96D1F6F9DE3DD582C314

Function 00007FFDFAAF4354 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFDFAAF4380
_PyUnicode_ToDecimalDigit.PYTHON312 ref: 00007FFDFAAF439F
PyErr_SetString.PYTHON312 ref: 00007FFDFAAF43BF
PyLong_FromLong.PYTHON312 ref: 00007FFDFAAF43D9

Strings

not a decimal, xrefs: 00007FFDFAAF43B5

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
String ID: not a decimal
API String ID: 3750391552-3590249192
Opcode ID: babd95680f3a021cdbe90a8980b0a1372c723c98da362c4ed99ce49efb4cea9f
Instruction ID: a58688b74fa24315510f1514a26f9e3241c0772e146cafdef75f91315b9a892b
Opcode Fuzzy Hash: babd95680f3a021cdbe90a8980b0a1372c723c98da362c4ed99ce49efb4cea9f
Instruction Fuzzy Hash: 34114621B18BC782EB5D9B16D47493C77A1AF44B84F4445B0CE6E876DCDF2CE85A8300

Function 00007FFE013B22F7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFE013B7F90
ERR_new.LIBCRYPTO-3 ref: 00007FFE013B7FBF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013B7FD7

Strings

dtls1_check_timeout_num, xrefs: 00007FFE013B7FC4
..\s\ssl\d1_lib.c, xrefs: 00007FFE013B7FD0

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_ctrlR_newR_set_debug
String ID: ..\s\ssl\d1_lib.c$dtls1_check_timeout_num
API String ID: 2442628283-2777391390
Opcode ID: 39901f4e62ad7e000960025d007d9c30c9bf97b8169bcd8fb6b77f78ad79f457
Instruction ID: 9a4f4c4a3839b2077d10a29f0851844d0316c993efd762e222a08212d29d4191
Opcode Fuzzy Hash: 39901f4e62ad7e000960025d007d9c30c9bf97b8169bcd8fb6b77f78ad79f457
Instruction Fuzzy Hash: 7D117072E1868282E790AB65D8916FC37A1EF84B40F850035DB0D4F7F1EF2CD585C614

Function 00007FFDFAAF4A64 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFDFAAF4A9F
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAAF4AD4

Strings

argument 1, xrefs: 00007FFDFAAF4ACD
name, xrefs: 00007FFDFAAF4A98, 00007FFDFAAF4AC6
a unicode character, xrefs: 00007FFDFAAF4ABF

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$name
API String ID: 3876575403-4190364640
Opcode ID: 788619a113f5b482446816568c8a6ce6929a34ab923ea752a318f2ec33933934
Instruction ID: 20db92fbd703578467072b1b899554c86698884e4202af41e63ea51aebb7ce6f
Opcode Fuzzy Hash: 788619a113f5b482446816568c8a6ce6929a34ab923ea752a318f2ec33933934
Instruction Fuzzy Hash: 62119031B08BC296EB1CAF51E4609A97360EB44B84F988076DA2D4779DCF3CE59AC300

Function 00007FFDFAAF4BA4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFDFAAF4BDF
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAAF4C14

Strings

numeric, xrefs: 00007FFDFAAF4BD8, 00007FFDFAAF4C06
argument 1, xrefs: 00007FFDFAAF4C0D
a unicode character, xrefs: 00007FFDFAAF4BFF

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$numeric
API String ID: 3876575403-2385192657
Opcode ID: bbdd109889d573d2d770b99f749a56ec45e44fab925d66d6427c2491f45a32cb
Instruction ID: 62ca97108de842dc9eb28051899902200f7a5fdb7e1a8dcfee4e2a158185031a
Opcode Fuzzy Hash: bbdd109889d573d2d770b99f749a56ec45e44fab925d66d6427c2491f45a32cb
Instruction Fuzzy Hash: 49116331B08BC296EB5C9F51E4609A97360EB44B84F984072DA2D477ADCF2DD59BC700

Function 00007FFDFAAF42A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFDFAAF42DB
_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAAF4310

Strings

argument 1, xrefs: 00007FFDFAAF4309
decimal, xrefs: 00007FFDFAAF42D4, 00007FFDFAAF4302
a unicode character, xrefs: 00007FFDFAAF42FB

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$decimal
API String ID: 3876575403-2474051849
Opcode ID: 1e4fff75323d13296d4f9873b31303b2eb894daa88b12eee96b04a04f0936518
Instruction ID: aab9462985f0799a3f4a4307bc53e3ae3e553f1c859cd76a0e0cf16c37a5eafe
Opcode Fuzzy Hash: 1e4fff75323d13296d4f9873b31303b2eb894daa88b12eee96b04a04f0936518
Instruction Fuzzy Hash: 53116031B18BC296EB5CDF52E4609A97360EB44B84F984172DE2D477ADCF2CE58AC700

Function 00007FFDFAAF4970 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAAF49A0
PyErr_Occurred.PYTHON312 ref: 00007FFDFAAF49CF

Strings

argument, xrefs: 00007FFDFAAF4992
a unicode character, xrefs: 00007FFDFAAF498B
mirrored, xrefs: 00007FFDFAAF4999

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Arg_ArgumentErr_Occurred
String ID: a unicode character$argument$mirrored
API String ID: 3979797681-4001128513
Opcode ID: 450df9025a0dac1254f35d1cfdfe59c877f6086a6bdfc57fc8ee28b17aa84801
Instruction ID: b7178b5a058261c454b0ff5f66e836b7d5854b9f3fb1c0f1995c58b9f7a12f72
Opcode Fuzzy Hash: 450df9025a0dac1254f35d1cfdfe59c877f6086a6bdfc57fc8ee28b17aa84801
Instruction Fuzzy Hash: 0201B160F08BC392EB1C9B65A8A09B833A0FF48754F8482B1C57D432DDCE3DE59A8300

Function 00007FFDFAAF41B4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FFDFAAF41E4
PyErr_Occurred.PYTHON312 ref: 00007FFDFAAF4213

Strings

combining, xrefs: 00007FFDFAAF41DD
argument, xrefs: 00007FFDFAAF41D6
a unicode character, xrefs: 00007FFDFAAF41CF

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Arg_ArgumentErr_Occurred
String ID: a unicode character$argument$combining
API String ID: 3979797681-4202047184
Opcode ID: 23a79bd7f21a28e7400453b17a2d46dedd5221c58aaec7069aa9642920e7cd67
Instruction ID: cf39789c273fe067e9173506bd81dbf0324870ca4fb6fcf8df02e4d40d940d57
Opcode Fuzzy Hash: 23a79bd7f21a28e7400453b17a2d46dedd5221c58aaec7069aa9642920e7cd67
Instruction Fuzzy Hash: 5C015E64F08BC382EB2C9B65A8609B933A0BF09754F8406B5D56D472DDDE3CE59A8710

Function 00007FFDFAAF2630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312(?,?,00000000,00007FFDFAAF256A), ref: 00007FFDFAAF263B
PyCapsule_New.PYTHON312(?,?,00000000,00007FFDFAAF256A), ref: 00007FFDFAAF2678
PyErr_NoMemory.PYTHON312(?,?,00000000,00007FFDFAAF256A), ref: 00007FFDFAAF3EC8
PyMem_Free.PYTHON312(?,?,00000000,00007FFDFAAF256A), ref: 00007FFDFAAF3ED8

Strings

unicodedata._ucnhash_CAPI, xrefs: 00007FFDFAAF266D

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Mem_$Capsule_Err_FreeMallocMemory
String ID: unicodedata._ucnhash_CAPI
API String ID: 3673501854-3989975041
Opcode ID: 89b48c636968bcc96ff5c1323bcf06e5fb317347bf56e69214e0fa8ba2ac5adf
Instruction ID: 8c5f60157708c4a264123bae55e1dc4912788ce100964be8503232cd72383e70
Opcode Fuzzy Hash: 89b48c636968bcc96ff5c1323bcf06e5fb317347bf56e69214e0fa8ba2ac5adf
Instruction Fuzzy Hash: F0F0F621B09B8395EF4D9B11A86487873A8BF18B80B8414B2C96E063DCEF3CE04E8310

Function 00007FF77C649AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF77C649B1D
GetProcAddress.KERNEL32 ref: 00007FF77C649B33
FreeLibrary.KERNEL32 ref: 00007FF77C649B5A

Strings

mscoree.dll, xrefs: 00007FF77C649B14
CorExitProcess, xrefs: 00007FF77C649B2C

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: 9ced3c645f015e697a5780e9d48ce8881e89055408235c85ab89a4174471f434
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: 75F0C822B3870681EB11AB10E4C473BA322AF8C765F940235CA6DC61F4DF2CD144C760

Function 00007FFE013B10FA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013B9C8A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013B9CA0
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013B9CB0

Strings

..\s\ssl\pqueue.c, xrefs: 00007FFE013B9C73, 00007FFE013B9C99
pqueue_new, xrefs: 00007FFE013B9C8F

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\pqueue.c$pqueue_new
API String ID: 1552677711-2823724430
Opcode ID: fb0ab7120b774717ea5e65c5d51e89b8a88c4a3480cf85109d1472291332eba0
Instruction ID: 47b5dc9632bb97e64d997977266cc33455813cb5afce5ce8868b137d9c6cb193
Opcode Fuzzy Hash: fb0ab7120b774717ea5e65c5d51e89b8a88c4a3480cf85109d1472291332eba0
Instruction Fuzzy Hash: C1F082B1A2950786EB10AB25D491AFC3760EF94309F854030D60C0E6B2FD2CF586D711

Function 00007FFE013B242D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013D9BD2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013D9BEA
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013D9BFB

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFE013D9BE3
SSL_CTX_use_PrivateKey, xrefs: 00007FFE013D9BD7

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_rsa.c$SSL_CTX_use_PrivateKey
API String ID: 1552677711-4052895991
Opcode ID: 9daced5f998ba57ab96cca589483a89accf4ae80a8c5eb3a5c4f322615c24db7
Instruction ID: 67377fd0762afbef8e51c5562bc788554212066606143828482a4167d4c88da6
Opcode Fuzzy Hash: 9daced5f998ba57ab96cca589483a89accf4ae80a8c5eb3a5c4f322615c24db7
Instruction Fuzzy Hash: C8E06D24F1A54282FB94A7649C966FC1292EF90308FE14031E10D4E6B2ED1CA5868741

Function 00007FFE013E3AA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013E3AB2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013E3ACA
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013E3ADB

Strings

SSL_set_tlsext_max_fragment_length, xrefs: 00007FFE013E3AB7
..\s\ssl\t1_lib.c, xrefs: 00007FFE013E3AC3

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\t1_lib.c$SSL_set_tlsext_max_fragment_length
API String ID: 1552677711-2316233728
Opcode ID: 608b61db3cdf58d17971493a14c54aa8bfca0a16146cdac516a42e646ef2d706
Instruction ID: 92346d1afca03631c1e9cc65df3a354cd19d68ea42611468f6bc01bd5bd44c2f
Opcode Fuzzy Hash: 608b61db3cdf58d17971493a14c54aa8bfca0a16146cdac516a42e646ef2d706
Instruction Fuzzy Hash: F0E01229E1A08187F794F364D8967ED1642DFA0301FD14031E10C4E6F2ED6DA5CB8612

Function 00007FFE013CBFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013CBFBD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013CBFD5
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013CBFE6

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013CBFCE
ssl_undefined_function, xrefs: 00007FFE013CBFC2

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_undefined_function
API String ID: 1552677711-2204979087
Opcode ID: 97566e4984a999399f7175b0fee9c0cdaef0284998aed2d6b61526290154574e
Instruction ID: 043a854b7f74fbc8a466d4da55945df532a97a094324009b12f559c5ae3daf96
Opcode Fuzzy Hash: 97566e4984a999399f7175b0fee9c0cdaef0284998aed2d6b61526290154574e
Instruction Fuzzy Hash: 78E01224F29452A3E394F760D8966FD1211EF94310FD04031E00C4A9F2EE2CA5868652

Function 00007FFE013CBF50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE013CBF5D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013CBF75
ERR_set_error.LIBCRYPTO-3 ref: 00007FFE013CBF86

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFE013CBF6E
ssl_undefined_function, xrefs: 00007FFE013CBF62

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_undefined_function
API String ID: 1552677711-2204979087
Opcode ID: 106ea3728cd96646050301ec46a3bce779a8684066028cd138f64911fd286165
Instruction ID: 043a854b7f74fbc8a466d4da55945df532a97a094324009b12f559c5ae3daf96
Opcode Fuzzy Hash: 106ea3728cd96646050301ec46a3bce779a8684066028cd138f64911fd286165
Instruction Fuzzy Hash: 78E01224F29452A3E394F760D8966FD1211EF94310FD04031E00C4A9F2EE2CA5868652

Function 00007FFDFACAAB30 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 381COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFACAABCF

Strings

vtable constructor failed: %s, xrefs: 00007FFDFACAAD1B
vtable constructor called recursively: %s, xrefs: 00007FFDFACAACD6
hidden, xrefs: 00007FFDFACAAF8D
vtable constructor did not declare schema: %s, xrefs: 00007FFDFACAAE4A

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memcpy
String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
API String ID: 3510742995-1299490920
Opcode ID: 2623641340c733b794af5866e5bcb4bdb6316ec65f5e7f2dcf12a73dcdb92bb2
Instruction ID: 0acecb21d154694bbcc4835b3afe3e53df0788889a0264df610222246f8db914
Opcode Fuzzy Hash: 2623641340c733b794af5866e5bcb4bdb6316ec65f5e7f2dcf12a73dcdb92bb2
Instruction Fuzzy Hash: 7CF1CC6AB19B8681EB588B11D460B7E77A1FB44B94F4482B1DE6D0B7D8DF3CE852C300

Function 00007FFDFAC35C10 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAC35D24
memset.VCRUNTIME140 ref: 00007FFDFAC35EB7

Strings

database corruption, xrefs: 00007FFDFAC3605E
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFDFAC36051
%s at line %d of [%.10s], xrefs: 00007FFDFAC3606A

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 2221118986-3764764234
Opcode ID: ba5d2802316911a7491cadce116daa97ccd6123211c9d747203731b79c4598ca
Instruction ID: 4a6f40287b55b5378e6c26fbf5077681cf27b0904b6409e7b00aa47643ae1bda
Opcode Fuzzy Hash: ba5d2802316911a7491cadce116daa97ccd6123211c9d747203731b79c4598ca
Instruction Fuzzy Hash: 27D1AD367087898AD768CF25E024AAD77A8FB88B84F558076DF9D47798DF39D481C300

Function 00007FFDFAC392B0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFAC37BA0: memcpy.VCRUNTIME140 ref: 00007FFDFAC37C0C
Part of subcall function 00007FFDFAC37BA0: memcpy.VCRUNTIME140 ref: 00007FFDFAC37C33

memcpy.VCRUNTIME140 ref: 00007FFDFAC3951F
memcpy.VCRUNTIME140 ref: 00007FFDFAC39535

Strings

database corruption, xrefs: 00007FFDFAC3936A
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFDFAC39351
%s at line %d of [%.10s], xrefs: 00007FFDFAC39371

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 3510742995-3764764234
Opcode ID: 898f60ba5d30a691837549c26709609510d03b6403a49f9c5c703c2500f0ffd9
Instruction ID: c9a02be259be46012fe031c9919fab580dc58e2d29094830e69b744e0f9085c2
Opcode Fuzzy Hash: 898f60ba5d30a691837549c26709609510d03b6403a49f9c5c703c2500f0ffd9
Instruction Fuzzy Hash: E781DE7AB0878296EB58CB29D464BAD77A4FB48B84F008072DB5E477D9DF38E485C740

Function 00007FFDFAC36C20 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 191COMMON

Download Yara Rule

Strings

database corruption, xrefs: 00007FFDFAC36CDF
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFDFAC36CCC
%s at line %d of [%.10s], xrefs: 00007FFDFAC36CE6

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 0-3764764234
Opcode ID: d7bbc113d95c405dff7a55cfefdeaeb98036685461038bdd9bca21eed79271cd
Instruction ID: d676ec28846c67d7b7ddb7ef07cfac7317edfe78810ea39580e9d789177f350d
Opcode Fuzzy Hash: d7bbc113d95c405dff7a55cfefdeaeb98036685461038bdd9bca21eed79271cd
Instruction Fuzzy Hash: 1581E3267083D15AEB288B25D5A0ABEBBA0FB40B84F044176DBED476C9DF3CE495C750

Function 00007FF77C6593D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF77C659400
_set_statfp.LIBCMT ref: 00007FF77C65941B
_set_statfp.LIBCMT ref: 00007FF77C659437
_set_statfp.LIBCMT ref: 00007FF77C659473

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: c1bccfd014470de4f93a445bf6febcdfd3de8bd4f414ac617918c4f9659566c7
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: A711BF63F3CA1301FB663124F5D6377A0476F5C360EA40634EB6EC62D6AE2CAC438120

Function 00007FF77C64B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF77C64A613,?,?,00000000,00007FF77C64A8AE,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64B41F
FlsSetValue.KERNEL32(?,?,?,00007FF77C64A613,?,?,00000000,00007FF77C64A8AE,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64B43E
FlsSetValue.KERNEL32(?,?,?,00007FF77C64A613,?,?,00000000,00007FF77C64A8AE,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64B466
FlsSetValue.KERNEL32(?,?,?,00007FF77C64A613,?,?,00000000,00007FF77C64A8AE,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64B477
FlsSetValue.KERNEL32(?,?,?,00007FF77C64A613,?,?,00000000,00007FF77C64A8AE,?,?,?,?,?,00007FF77C64A83A), ref: 00007FF77C64B488

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: ccac5f17aa91da4f3bae42de7e7333904383ed8f97faa160faf07aaa8124ee46
Instruction ID: c5bef97d19db0611c37f6753456b20e2e42877948ced5a7867b92fcfcbd1940a
Opcode Fuzzy Hash: ccac5f17aa91da4f3bae42de7e7333904383ed8f97faa160faf07aaa8124ee46
Instruction Fuzzy Hash: FD114D36A38A0241FB5AB36595D117BF1535F8C7B0F848334D82DCA6DADE2CE7028721

Function 00007FF77C64B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF77C64B2A5
FlsSetValue.KERNEL32 ref: 00007FF77C64B2C4
FlsSetValue.KERNEL32 ref: 00007FF77C64B2EC
FlsSetValue.KERNEL32 ref: 00007FF77C64B2FD
FlsSetValue.KERNEL32 ref: 00007FF77C64B30E

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 189bd32c29972b75cbfb961d88c763c1323b9a0b7d58335ae669547dde4e0126
Instruction ID: edbe6294b333b6ed2f12b73631b5c1f2b24e4e87b45380b3f23166e9f87ceedd
Opcode Fuzzy Hash: 189bd32c29972b75cbfb961d88c763c1323b9a0b7d58335ae669547dde4e0126
Instruction Fuzzy Hash: 9211D226A3860641FB5A73A284A117BB1534F8D720F885734D92E8E2C2DD2CA7025222

Function 00007FFE013B252C Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFE013C1BB8
X509_get_subject_name.LIBCRYPTO-3 ref: 00007FFE013C1BCC
X509_NAME_dup.LIBCRYPTO-3 ref: 00007FFE013C1BD4
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFE013C1BEB
X509_NAME_free.LIBCRYPTO-3 ref: 00007FFE013C1BF7

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: X509_$E_dupE_freeL_sk_new_nullL_sk_pushX509_get_subject_name
String ID:
API String ID: 2231116090-0
Opcode ID: 5358efc33fb6e18c454b589764754550d33877bf110f5fb8f4b70bee4f8048f6
Instruction ID: c551cf78f65d7d5fc158fcaf6a9ab546e3d3b1bd8bb5b0a438bb53919bd545d4
Opcode Fuzzy Hash: 5358efc33fb6e18c454b589764754550d33877bf110f5fb8f4b70bee4f8048f6
Instruction Fuzzy Hash: 9F014B25E0964280EF95A666A9557BC5290AF58BC0F594030EE4D4EBB7FE2CE4914701

Function 00007FFE013B200E Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFE013C1DD8
X509_get_subject_name.LIBCRYPTO-3 ref: 00007FFE013C1DEC
X509_NAME_dup.LIBCRYPTO-3 ref: 00007FFE013C1DF4
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFE013C1E0B
X509_NAME_free.LIBCRYPTO-3 ref: 00007FFE013C1E17

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: X509_$E_dupE_freeL_sk_new_nullL_sk_pushX509_get_subject_name
String ID:
API String ID: 2231116090-0
Opcode ID: 311ce1e4a6a9474514a48b18637f768dcf6c3ad028354252edc0f8d4a87dfe69
Instruction ID: c6860248c290097f4e5966b2e62cba1c6add1ecdbdc4157fca594b125e4b8a44
Opcode Fuzzy Hash: 311ce1e4a6a9474514a48b18637f768dcf6c3ad028354252edc0f8d4a87dfe69
Instruction Fuzzy Hash: 0B016D25F0A64280FFD5A766A5957BD91909F54BD0F690030EE0D8FBE7FE2CE4914701

Function 00007FF77C646010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C646176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64622C

Strings

verbose, xrefs: 00007FF77C646020

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: c0937a6d003a2bc45d3255ea6de0033a3cd4150c306ce904a5500011a30514df
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 8591B673A3CA4691F762AF24D4903BFB692AB48B54FC44136DA498B3D5DE3CE7458320

Function 00007FF77C64FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C64FF17

Part of subcall function 00007FF77C647AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C647AC9

Strings

UTF-16LEUNICODE, xrefs: 00007FF77C64FEB5
ccs, xrefs: 00007FF77C64FE52
UTF-8, xrefs: 00007FF77C64FE96

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: 52a6b65dd5cc80f40b595ec834c58158d6b3d525f66e6237ecdbe51c83c78dea
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 7B81B333D3824395F7A66E25818067BB6E3AB19748FD54035DA09DF285DF2DE7028323

Function 00007FFE013E1F98 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 214COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_new.LIBCRYPTO-3 ref: 00007FFE013E2103
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E2114
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013E212C
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E2161
COMP_CTX_free.LIBCRYPTO-3 ref: 00007FFE013E217E
COMP_CTX_new.LIBCRYPTO-3 ref: 00007FFE013E2197
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E21A8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013E21C0
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFE013E2295
ERR_new.LIBCRYPTO-3 ref: 00007FFE013E22A2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE013E27F2

Strings

tls1_change_cipher_state, xrefs: 00007FFE013E2166
..\s\ssl\t1_enc.c, xrefs: 00007FFE013E27EB

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_new$R_set_debugX_new$X_free
String ID: ..\s\ssl\t1_enc.c$tls1_change_cipher_state
API String ID: 1274617517-2635170098
Opcode ID: 0037dc27bd105c92f0a519367c08924de81d128fbb679af6c868e3eb35bc142d
Instruction ID: 7cd891a8f39fb17f92f607868f2f805953abb7247e2e03e95cda860db99f701e
Opcode Fuzzy Hash: 0037dc27bd105c92f0a519367c08924de81d128fbb679af6c868e3eb35bc142d
Instruction Fuzzy Hash: CB31D332718B8196E359CB26D9807AA67D0FB88794F540135EF0C4B7A0DF3CE1A2CB00

Function 00007FF77C63D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF77C63D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF77C63D77A
RtlUnwindEx.KERNEL32 ref: 00007FF77C63D7D4

Strings

csm, xrefs: 00007FF77C63D761

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: 6965e2ac0e314fd2add5ffe01aa573cb129229d4cc9183fb06e58b3baa733d64
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 45518333B396018ADB15EB15D494A7AB7A2EB48B98F904134DF4E87784DF7CE841C710

Function 00007FF77C63EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF77C63EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF77C63EFF3

Strings

MOC, xrefs: 00007FF77C63EFBB
RCC, xrefs: 00007FF77C63EFC3

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: a2a02dfb21cc193966ec202216a771b008e98c3e8b6102a07628f7df882fbbf0
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 4E61AF33928BC581EB61AB15E4807AAF7A1FB88B84F444235EB9C47B95CF7CD194CB11

Function 00007FF77C63F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF77C63F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF77C63F408

Strings

csm, xrefs: 00007FF77C63F45A
csm, xrefs: 00007FF77C63F342

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: d693e4f61bb5b1242a56cebd355170672a6e035f31b01394ff97e53c60670301
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: 0C51A23393824286EF65AE21908436AB692FB58B94F944175EA4D87796CF3CE450C722

Function 00007FFE013B2699 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFE01403D66
tls_construct_ctos_server_name, xrefs: 00007FFE01403D5A

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_server_name
API String ID: 0-1970769450
Opcode ID: 5c9d1c86b3ee07b7b72a52ca61cd4e0638b72d7c6e02d8d0b965126d0c4b85b8
Instruction ID: 4a968b8f96b20993243c139d6df4c0e1c16eeb396ff2cf8221b3bf00856d8b6a
Opcode Fuzzy Hash: 5c9d1c86b3ee07b7b72a52ca61cd4e0638b72d7c6e02d8d0b965126d0c4b85b8
Instruction Fuzzy Hash: 60318F11F1C14345FB66AB67B9517B91682AF85B84F485034EE0E8F6F6ED2CE8828700

Function 00007FF77C637E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF77C63352C,?,00000000,00007FF77C633F23), ref: 00007FF77C637F22

Strings

%s%c, xrefs: 00007FF77C637E94
%.*s, xrefs: 00007FF77C637EDB
\, xrefs: 00007FF77C637E87

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
Instruction ID: ce051cdecd649ffd4b8b906fc6b4726a4461688e1ba2e9fab7c7db271e23a92d
Opcode Fuzzy Hash: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
Instruction Fuzzy Hash: 7431BA22739AC145EB22A711A9907A7A355FF8CBE4F840231EE6D877C9DF2CD601C710

Function 00007FF77C632810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF77C6328EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF77C632868
Error, xrefs: 00007FF77C6328DD
ERROR, xrefs: 00007FF77C63286F

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: 1b4244a08fd30e2f190c53808feb9a4b1aee219eb70209380e508cd193ebd343
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: CF21B173B28B4192E712AB14B4807ABB3A1EB8C780F804132EE8D9765ADE3CD245C710

Function 00007FFE013B1C8F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01401D45
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01401D5D

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFE01401D56
tls_construct_ctos_alpn, xrefs: 00007FFE01401D4A

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_alpn
API String ID: 193678381-4282401781
Opcode ID: 82db74567b07ca98429e2d491a144afa58134e21642959cb42d781465d250f73
Instruction ID: 9255d2546164c4c55ec7a001717f922eb557335cf1f83b2d848986738b259810
Opcode Fuzzy Hash: 82db74567b07ca98429e2d491a144afa58134e21642959cb42d781465d250f73
Instruction Fuzzy Hash: 2B215E61B1814242F791AB56E5957FE2251EF44B88F480035EE4C4F6F6EF7DE8828300

Function 00007FFE01401B85 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01401C04
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01401C1C

Strings

ssl_next_proto_validate, xrefs: 00007FFE01401C09
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFE01401C15

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$ssl_next_proto_validate
API String ID: 193678381-4274311015
Opcode ID: 7dea40406266602161a6404743dd7ce781170104bfc31af87b83c6f7a9f0ceb9
Instruction ID: 7e9663b2173c55a1d2a8bc1342a26a0a1ec1fa16ecfe7db71f19b587aee95f64
Opcode Fuzzy Hash: 7dea40406266602161a6404743dd7ce781170104bfc31af87b83c6f7a9f0ceb9
Instruction Fuzzy Hash: 3411CA72F1E58182EB559765E8503FA6390EF54744F449535EB8C4A6B1FF3CD6C08600

Function 00007FFE013B1889 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57COMMON

Download Yara Rule

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFE01403B27
tls_construct_ctos_renegotiate, xrefs: 00007FFE01403B1B

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_renegotiate
API String ID: 0-2485672351
Opcode ID: 9e2356e0d1aca21d8efb9cf5ed6ac8109dbbc19e3386223d1c3c152121950f0c
Instruction ID: 270530a78fe3f5d49fb216c75a7699c955dbee65eb8aa3909d30c203e33b4d49
Opcode Fuzzy Hash: 9e2356e0d1aca21d8efb9cf5ed6ac8109dbbc19e3386223d1c3c152121950f0c
Instruction Fuzzy Hash: 08116D21F1C54382FB54AB62FA917B91651AF847C8F881035EE0D4FAF7EE6CE9918740

Function 00007FFE013B18F7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFE01429E53
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFE01429E6B

Strings

tls_post_process_client_key_exchange, xrefs: 00007FFE01429E58
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFE01429E64

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$tls_post_process_client_key_exchange
API String ID: 193678381-3756838607
Opcode ID: 57110426fcb3f328b78f79e07f141f40403a10eee66626d20c3a0f6ae89a6ee1
Instruction ID: 8ff3c7c22b74edc9d52bd173ddabc1f6db378063e157dcf66df88a5a34f7af77
Opcode Fuzzy Hash: 57110426fcb3f328b78f79e07f141f40403a10eee66626d20c3a0f6ae89a6ee1
Instruction Fuzzy Hash: 3C017C62F1950282F760ABA5D8867FD1291EFA0758F980430E50C8E2F2EE7DA9C2C201

Function 00007FFDFAAF1EF0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312(?,?,?,?,?,00007FFDFAAF1EDC), ref: 00007FFDFAAF3B31

Part of subcall function 00007FFDFAAF1FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAAF2008
Part of subcall function 00007FFDFAAF1FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAAF2026

PyErr_Format.PYTHON312 ref: 00007FFDFAAF1F53

Strings

undefined character name '%s', xrefs: 00007FFDFAAF1F46
name too long, xrefs: 00007FFDFAAF3B27

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Err_strncmp$FormatString
String ID: name too long$undefined character name '%s'
API String ID: 3882229318-4056717002
Opcode ID: fe9fd46e1f898954a40cc435b1b2d9c6909a3f099c322250393b7a83e7c0a7cf
Instruction ID: 57bb60894a06f39daf8a7878e4b63d2387c6691a09303b42e3732b4f20174806
Opcode Fuzzy Hash: fe9fd46e1f898954a40cc435b1b2d9c6909a3f099c322250393b7a83e7c0a7cf
Instruction Fuzzy Hash: 25112176B18B8791EB0C9B14D4A4AB47364FB88749F840572CB2D462E9DF6DE14FC700

Function 00007FFE013B1375 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

ossl_statem_server_write_transition, xrefs: 00007FFE01425F3C
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFE01425F48

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem_srvr.c$ossl_statem_server_write_transition
API String ID: 0-415349073
Opcode ID: cb928233245477158d164dc25a4f82f7329a45cbb3b201dbca18578d772069f8
Instruction ID: 98668013fc1fca65547231daed9e6a18179089daddccf7a4e4ffb12782cbd1ed
Opcode Fuzzy Hash: cb928233245477158d164dc25a4f82f7329a45cbb3b201dbca18578d772069f8
Instruction Fuzzy Hash: 3401F522F2924283E754D755D8957FC2311EBA8744FE48032DA0C8F3B1DE2CE5C2C602

Function 00007FFE013EDF9A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FFE013EDFCC
BIO_printf.LIBCRYPTO-3 ref: 00007FFE013EDFFF

Part of subcall function 00007FFE013EE210: BIO_printf.LIBCRYPTO-3(?,00007FFE013EB69A), ref: 00007FFE013EE254
Part of subcall function 00007FFE013EE210: BIO_printf.LIBCRYPTO-3(?,00007FFE013EB69A), ref: 00007FFE013EE26F

Strings

%s (%d), xrefs: 00007FFE013EDFF2
unexpected value, xrefs: 00007FFE013EDFAB

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_printf$O_indent
String ID: %s (%d)$unexpected value
API String ID: 1715996925-1289549259
Opcode ID: b82d1fbfaac1b7f49c66747b67c6d75daf745cdbd783dcc07c1ce5a27fa2681d
Instruction ID: 11eab012857834bc8858e8928a6b2c1a3a78337d11184537a8354d181a1e0403
Opcode Fuzzy Hash: b82d1fbfaac1b7f49c66747b67c6d75daf745cdbd783dcc07c1ce5a27fa2681d
Instruction Fuzzy Hash: C0F0A920A0C74282E7209B95D0009BD3292EF90B80F964532EC0D0F6FDCE3CE646C205

Function 00007FF77C64C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF77C64C68F
WriteFile.KERNEL32 ref: 00007FF77C64C957
WriteFile.KERNEL32 ref: 00007FF77C64C99D
GetLastError.KERNEL32 ref: 00007FF77C64CA53

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: c7ab6ffb38eee2db5e57db636f10ec2fcfe27a63951b347fa77dbfaa6c59ab3a
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: 97D13673B38A409AE712DF65D4801AD7772FB487D8B808235DE5E9BB89DE38D246C350

Function 00007FFDFAC1DBB0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 249COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAC1DC3C

Strings

winOpenShm, xrefs: 00007FFDFAC1DE49
readonly_shm, xrefs: 00007FFDFAC1DDDA
%s-shm, xrefs: 00007FFDFAC1DC53

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memset
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 2221118986-2815843928
Opcode ID: 8d2a6488cfe544708466a8bb6c48c74f0afd239d4f67e3118775d9e63ad55e06
Instruction ID: ab9263c6a49b0c09085c601ccf01bf458dd6aa7ed050dc1878bbeb080eb9dbb5
Opcode Fuzzy Hash: 8d2a6488cfe544708466a8bb6c48c74f0afd239d4f67e3118775d9e63ad55e06
Instruction Fuzzy Hash: 45C15B29B0AA4691EB5D9B21E860A7D33A0FF48B50F0446B5DA7E477E8EF3CE445C350

Function 00007FFDFACA42F0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,00000080,?,00000000,00007FFDFACA47C2), ref: 00007FFDFACA449B
memcpy.VCRUNTIME140(?,?,?,?,?,?,00000080,?,00000000,00007FFDFACA47C2), ref: 00007FFDFACA451E
memcpy.VCRUNTIME140(?,?,?,?,?,?,00000080,?,00000000,00007FFDFACA47C2), ref: 00007FFDFACA460B

Strings

RETURNING may not use "TABLE.*" wildcards, xrefs: 00007FFDFACA4371

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memcpy
String ID: RETURNING may not use "TABLE.*" wildcards
API String ID: 3510742995-2313493979
Opcode ID: 6bac7e3f1474ddabb9d0e3377e88d9ee408727fdfbaf5356aee17a161c2ff753
Instruction ID: eb1b6b4355a3c21a31a12e92cbbf4134ad87b14d462ac533a7798e019ef93e67
Opcode Fuzzy Hash: 6bac7e3f1474ddabb9d0e3377e88d9ee408727fdfbaf5356aee17a161c2ff753
Instruction Fuzzy Hash: FAB18B26B08B8185EB18CF15E6606BD77A1FB84BA4F458275DA7D0B7D9DF38E194C300

Function 00007FF77C64CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77C64CFBB), ref: 00007FF77C64D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77C64CFBB), ref: 00007FF77C64D177

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: 9bcbff13d573288282b5b02289e3beb4b2873bfd979ac45536a91a6ebeef06f2
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: C791A723F3865195F792AF65D4C027FBBA2BB48B88F944135DF0E9B685CE38D6418720

Function 00007FFDFAC95C50 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 197COMMON

Download Yara Rule

Strings

rowid, xrefs: 00007FFDFAC95DAE
column%d, xrefs: 00007FFDFAC95E58
%s.%s, xrefs: 00007FFDFAC95DCE

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID: %s.%s$column%d$rowid
API String ID: 0-1505470444
Opcode ID: d1fe2ab18ba4c5494ba92163807286c015e8439aac513501ae0b7842bd63adfc
Instruction ID: 139662e4f66925ae1e40e8bdaab8c815856993cabfca799a2f0dae47de1295f8
Opcode Fuzzy Hash: d1fe2ab18ba4c5494ba92163807286c015e8439aac513501ae0b7842bd63adfc
Instruction Fuzzy Hash: 66919B2AB08B8585EB24DB1594647AD6BA8FB49BB8F144366DE7C073C8DF3CD445C300

Function 00007FFDFAAF1FD0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAAF2008
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDFAAF2026

Strings

CJK UNIFIED IDEOGRAPH-, xrefs: 00007FFDFAAF201C
HANGUL SYLLABLE , xrefs: 00007FFDFAAF1FF5

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: strncmp
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 1114863663-87138338
Opcode ID: d800521c55394c3ad25b6a38125f6762d0e11982fd6218b3e6ef33505340922b
Instruction ID: 0b72d00f935feb8fb0e4e32ad12387113eeee796ab5745df8c589ff907b00085
Opcode Fuzzy Hash: d800521c55394c3ad25b6a38125f6762d0e11982fd6218b3e6ef33505340922b
Instruction Fuzzy Hash: BE61D972B1878246E76CCA19A820ABA7752EB80790F444275EA7947BDDDF3CD80F8704

Function 00007FF77C64F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF77C64FAEC
_get_daylight.LIBCMT ref: 00007FF77C64FAFD
_get_daylight.LIBCMT ref: 00007FF77C64FB0E
_isindst.LIBCMT ref: 00007FF77C64FBD9

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 23ca9c12ba1978b4d5c20015507695e955a0a2c7a3bda9264c7e232cf9c106ba
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 04513873F381118AFB15EF2499D16BEB7A2AB08358F900235DE1DD6AE4DB38E601C711

Function 00007FFDFAC29360 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDFAC29488

Strings

database corruption, xrefs: 00007FFDFAC29552
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFDFAC29545
%s at line %d of [%.10s], xrefs: 00007FFDFAC2955E

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 2221118986-3764764234
Opcode ID: 8f983514268cc7df1290e166eec0b47a294775388fb5c19de4c52b4ac99553b0
Instruction ID: 064804d008763a3bf989d73f456ba0bef3bd2e3f0a612ee835ff82702efe9f2f
Opcode Fuzzy Hash: 8f983514268cc7df1290e166eec0b47a294775388fb5c19de4c52b4ac99553b0
Instruction Fuzzy Hash: 90518C2A708B8286EB58CB25D550AAD73E4FB48B84F584172DF6D43798EF38E451C340

Function 00007FF77C6457EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF77C64581F
GetFileInformationByHandle.KERNEL32 ref: 00007FF77C645881
GetLastError.KERNEL32 ref: 00007FF77C645912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77C645724), ref: 00007FF77C64595E

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: 5abc24d194951af423cac8284e64c59d93a2f0c5a19dfef73498942b8bd932ab
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 7F519233E38A418AFB11EF71D4903BE73A2AB48B58F944435DE4D9B689DF38D6418720

Function 00007FF77C6320C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF77C6320F4
SetWindowLongPtrW.USER32 ref: 00007FF77C632116
GetWindowLongPtrW.USER32 ref: 00007FF77C632140
InvalidateRect.USER32 ref: 00007FF77C632160

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: a1498169c64d959caea6e3caa2f081938b0370d7bf5f5b8b8bbd49c28f050398
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 28117332B3C14242F756A769B6C427B9393EF8C780FD48030DF4946B9ACD2DD5958224

Function 00007FFE013B1005 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

X509_get_subject_name.LIBCRYPTO-3 ref: 00007FFE013C1C7C
X509_NAME_dup.LIBCRYPTO-3 ref: 00007FFE013C1C84
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFE013C1C9B
X509_NAME_free.LIBCRYPTO-3 ref: 00007FFE013C1CA7

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: X509_$E_dupE_freeL_sk_pushX509_get_subject_name
String ID:
API String ID: 417592659-0
Opcode ID: d898f3ffb57c24a07e9b536fd1af60fcb2fce05c4d73ee68e49ec288db6db6df
Instruction ID: a72543d338a81ebe4282349d7cd42c1870bbf9396bba783502e6bc68e9e79fb1
Opcode Fuzzy Hash: d898f3ffb57c24a07e9b536fd1af60fcb2fce05c4d73ee68e49ec288db6db6df
Instruction Fuzzy Hash: 0701AD71F0A64280EF85A766A5843BC51809F58BD0F594030FE4D8FBA7FD2CE4900305

Function 00007FF77C63D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF77C63D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF77C63D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF77C63D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF77C63D0D6

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: 85532175cff1d26de166d2022245fc2d59380cc482b0a8a62b0afb519ab4363c
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 91111F26B28B05CAEB00DF60E8952BA73A4F75D758F440E31DE5D86764DF78D1548350

Function 00007FF77C655B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77C6517D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77C651803

_get_daylight.LIBCMT ref: 00007FF77C655CA4
_get_daylight.LIBCMT ref: 00007FF77C655CB5

Strings

?, xrefs: 00007FF77C655C35

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
Instruction ID: 88d2bcf0ecf928fac81b21821be19b5a10c2a475332170f567da06d6ff908be3
Opcode Fuzzy Hash: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
Instruction Fuzzy Hash: A8414E13B38A8241F7226715F48937BE652EB84BA4F60423AFF5C86AD9DE3CD441C710

Function 00007FF77C649084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6490B6

Part of subcall function 00007FF77C64A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9CE
Part of subcall function 00007FF77C64A9B8: GetLastError.KERNEL32(?,?,?,00007FF77C652D92,?,?,?,00007FF77C652DCF,?,?,00000000,00007FF77C653295,?,?,?,00007FF77C6531C7), ref: 00007FF77C64A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF77C63CC15), ref: 00007FF77C6490D4

Strings

C:\Users\user\Desktop\lz4wnSavmK.exe, xrefs: 00007FF77C6490C2

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\lz4wnSavmK.exe
API String ID: 3580290477-2746711996
Opcode ID: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
Instruction ID: 0884d2bb8c2d310e2fbb5d8fd1a69ee41a417566bbc2a288e83b60453dedf8ae
Opcode Fuzzy Hash: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
Instruction Fuzzy Hash: EA418133A38A02C5E716BF2595C14BEB396EB4CBC4BD54035E94D8BB85DE3DD6818320

Function 00007FF77C64CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF77C64CDBF
GetLastError.KERNEL32 ref: 00007FF77C64CDE1

Strings

U, xrefs: 00007FF77C64CD6B

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: 3bf149a663416871a8e823433cc20b563adee1bb7297b462979e70c55afafde2
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: B141A323B38A5191DB219F25E4843AAB7A1FB98794F904131EE4DC7798EF3CD601C750

Function 00007FFDFF3F2AF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDFF3F2B82

Strings

src/AESNI.c, xrefs: 00007FFDFF3F2B74
(idx>=1) && (idx<=10), xrefs: 00007FFDFF3F2B7B

Memory Dump Source

Source File: 00000001.00000002.1789715337.00007FFDFF3F1000.00000020.00000001.01000000.0000003C.sdmp, Offset: 00007FFDFF3F0000, based on PE: true

Associated: 00000001.00000002.1789684258.00007FFDFF3F0000.00000002.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789751805.00007FFDFF3F3000.00000002.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789778567.00007FFDFF3F4000.00000004.00000001.01000000.0000003C.sdmpDownload File
Associated: 00000001.00000002.1789802581.00007FFDFF3F5000.00000002.00000001.01000000.0000003C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdff3f0000_lz4wnSavmK.jbxd

Similarity

API ID: _wassert
String ID: (idx>=1) && (idx<=10)$src/AESNI.c
API String ID: 3234217646-2495715787
Opcode ID: f34cea9cfd06ae8d0bacecc527501edc0e611be2f02bd286901079fb247b3b81
Instruction ID: 6556685ba5fb9b2f2c6a7cf62c784e0df539f8a468d5c36ad50ebd462af6039f
Opcode Fuzzy Hash: f34cea9cfd06ae8d0bacecc527501edc0e611be2f02bd286901079fb247b3b81
Instruction Fuzzy Hash: 3F21973390D3C14BD7034F7594A949C7FB0DBD6B50B89C2AAC79483696EAAC98C7C711

Function 00007FF77C64F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF77C64F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF77C64F6BA

Strings

:, xrefs: 00007FF77C64F67E

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 4a9b1d6d16ab1fe6c903793d19c8bb2ed63e5c59599aead2cadc4c72b8df4769
Instruction ID: 8f8071e2971c9675147a6b75bf268c6153d44a2a205b82484bad481a81a6b509
Opcode Fuzzy Hash: 4a9b1d6d16ab1fe6c903793d19c8bb2ed63e5c59599aead2cadc4c72b8df4769
Instruction Fuzzy Hash: 0C21B163A3868182EB22AB11D48426EB3A3FB8CB44FD54035DA8C87694DF7CD7458B61

Function 00007FFE01411D15 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

-, xrefs: 00007FFE01411D34

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 2f2921c7d63689ddfb99d4ade919c5bad42a61964b70ce46f40baa056cf532e0
Instruction ID: 333d17d11b43be2556d34aa4f720860e86a723a3ea62d4c2182e269d4f2575d6
Opcode Fuzzy Hash: 2f2921c7d63689ddfb99d4ade919c5bad42a61964b70ce46f40baa056cf532e0
Instruction Fuzzy Hash: 54118272B1814186FB949F2AE19437D2791EB88B58F840135DB0D4F7AAEF7CE4D58B00

Function 00007FF77C63FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF77C63FE08
RaiseException.KERNEL32 ref: 00007FF77C63FE49

Strings

csm, xrefs: 00007FF77C63FE36

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: 665d6b28388d0edd8538baf9d53b4f6abdfb3a9500b757e5eb582e0cd4a00c8c
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: 8D112E32628B8582EB629F15F44026AB7E5FB8CB84F984270DF8D47759DF3CD5518B10

Function 00007FF77C6507AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77C6507DC
GetDriveTypeW.KERNEL32 ref: 00007FF77C65081C

Strings

:, xrefs: 00007FF77C650805

Memory Dump Source

Source File: 00000001.00000002.1786050425.00007FF77C631000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77C630000, based on PE: true

Associated: 00000001.00000002.1785941435.00007FF77C630000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786082771.00007FF77C65B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C66E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786109346.00007FF77C671000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1786251212.00007FF77C674000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff77c630000_lz4wnSavmK.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: c656d7984cd14de5c632a01b0ede08d5dc3cad7d8b4d8280c2711c614798db73
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: 33012523A3C60385F772BF60A4A627FB6A1EF4C748FD40435D64DC6691EE3CE5448A24

Function 00007FFDFAAF4B18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFDFAAF4B68
PyUnicode_FromString.PYTHON312 ref: 00007FFDFAAF4B85

Strings

no such name, xrefs: 00007FFDFAAF4B5E

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: String$Err_FromUnicode_
String ID: no such name
API String ID: 3678473424-4211486178
Opcode ID: ac25febba8f5bdc0c9cfa2e9817e8debf067cef10677f4d15bb58f151aba3dd9
Instruction ID: f55890667bc20d7be07b9fd0728f2820a0255ba1482f28e6940a9e810ca799e0
Opcode Fuzzy Hash: ac25febba8f5bdc0c9cfa2e9817e8debf067cef10677f4d15bb58f151aba3dd9
Instruction Fuzzy Hash: 6601127171878282EB5D9B21E860BA57394BB58784F440071DA5E467D9DF2CE10A8600

Function 00007FFE01411CD7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFE01411C8C
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFE01411C99

Strings

', xrefs: 00007FFE01411CE0

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: '
API String ID: 3946675294-1997036262
Opcode ID: 16a3f063fb489d9ee8e277fc181f23d388cc933931c730453a8515b2dc5c4302
Instruction ID: 882eb2ce5fa62ddca84004d66cdfabe3ee069f2193b294d6495e866419897eac
Opcode Fuzzy Hash: 16a3f063fb489d9ee8e277fc181f23d388cc933931c730453a8515b2dc5c4302
Instruction Fuzzy Hash: 2FF09062B0824186EB949F26E0C437D2791EB88B48F584139DB0D4F7EBDE7CD4C58700

Function 00007FFE01411C1A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFE01411C8C
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFE01411C99

Strings

&, xrefs: 00007FFE01411C1F

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: &
API String ID: 3946675294-1010288
Opcode ID: 13b142fd60ad240493ca7e773f80bdca150b6ad7018b79b77a9fe981096409fd
Instruction ID: c2985a78572cc2735d809ea7d115981c106a7b079b487c17c5d88ab410f88a8d
Opcode Fuzzy Hash: 13b142fd60ad240493ca7e773f80bdca150b6ad7018b79b77a9fe981096409fd
Instruction Fuzzy Hash: 48F09072B0824186EB94DF2AE0C437D2791EB88B48F584135DB0D4F7AADE7CD4C18700

Function 00007FFE013B22C5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

OSSL_PARAM_construct_octet_string.LIBCRYPTO-3 ref: 00007FFE013BBA96
OSSL_PARAM_construct_end.LIBCRYPTO-3 ref: 00007FFE013BBAB8

Strings

ssl3-ms, xrefs: 00007FFE013BBA8F

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: M_construct_endM_construct_octet_string
String ID: ssl3-ms
API String ID: 587842064-1523337083
Opcode ID: 07f37fcf04e0682dd5abfe62096895e85e18a59595d055de32fe19738c2c0bd8
Instruction ID: 2062ae05cfeb1e7a8af9f43e73b81d2999b2b06c970b6a8836e6778463c2d1ea
Opcode Fuzzy Hash: 07f37fcf04e0682dd5abfe62096895e85e18a59595d055de32fe19738c2c0bd8
Instruction Fuzzy Hash: C201EC52C08F8982E711DF38C5511BC7770FBA9B48B55A321EB8D26167EF28E2D5D740

Function 00007FFE01425ABE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFE014258C8
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFE014258D5

Strings

, xrefs: 00007FFE01425AC7

Memory Dump Source

Source File: 00000001.00000002.1791517135.00007FFE013B1000.00000020.00000001.01000000.00000013.sdmp, Offset: 00007FFE013B0000, based on PE: true

Associated: 00000001.00000002.1791490726.00007FFE013B0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791517135.00007FFE01433000.00000020.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791623570.00007FFE01435000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791687277.00007FFE0145D000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01462000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01468000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000001.00000002.1791713879.00007FFE01470000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe013b0000_lz4wnSavmK.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID:
API String ID: 3946675294-3916222277
Opcode ID: abd56ec179e8dc511f12abdbc92a8f9a103b85c798d31762858c552181ab4736
Instruction ID: 32a50d6aa3ffcf1e11fb955c34e1793ad5f76af242d42506137b00020689c5e2
Opcode Fuzzy Hash: abd56ec179e8dc511f12abdbc92a8f9a103b85c798d31762858c552181ab4736
Instruction Fuzzy Hash: 90F0A061F0524246FB945B2290D53BD1680DBA4B48F944034CA0C0F7E6DEFD94D58741

Function 00007FFDFAAF25C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_PyObject_GC_New.PYTHON312(?,?,00000000,00007FFDFAAF2533), ref: 00007FFDFAAF25C6
PyObject_GC_Track.PYTHON312(?,?,00000000,00007FFDFAAF2533), ref: 00007FFDFAAF25F8

Strings

3.2.0, xrefs: 00007FFDFAAF25D4

Memory Dump Source

Source File: 00000001.00000002.1787017206.00007FFDFAAF1000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FFDFAAF0000, based on PE: true

Associated: 00000001.00000002.1786994843.00007FFDFAAF0000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAAF5000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB52000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFAB9E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA2000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABA7000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787038304.00007FFDFABFF000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787230849.00007FFDFAC02000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000001.00000002.1787251719.00007FFDFAC04000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfaaf0000_lz4wnSavmK.jbxd

Similarity

API ID: Object_$Track
String ID: 3.2.0
API String ID: 16854473-1786766648
Opcode ID: f91d149df4c654f8be0df0ef2da4b36c9d06b56ee9d54162962ccaca08fa2000
Instruction ID: 02d21927e0a75b9458f6f4f17aa494bc07f12c5b049972115885ac767621e0fc
Opcode Fuzzy Hash: f91d149df4c654f8be0df0ef2da4b36c9d06b56ee9d54162962ccaca08fa2000
Instruction Fuzzy Hash: C1E0ED24B15B8291EF1D9B11E8644A473A8EF18705B5401B5CD6D02398EF3CE16EC240

Function 00007FFDFAC5ABE0 Relevance: 5.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FFDFAC5532C), ref: 00007FFDFAC5AD4A
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FFDFAC5532C), ref: 00007FFDFAC5AD75
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FFDFAC5532C), ref: 00007FFDFAC5AD91
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FFDFAC5532C), ref: 00007FFDFAC5ADD6

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 063867daf08dc840c18da87f71504e9cfd181ef9bf5db64338ac6d78780bbdb1
Instruction ID: 55c8c5caa7a4a06d71ee9891b8e300187cc9e483d4c7a85fdae7fc092589641c
Opcode Fuzzy Hash: 063867daf08dc840c18da87f71504e9cfd181ef9bf5db64338ac6d78780bbdb1
Instruction Fuzzy Hash: B691E236B186818AE728CB179524A6E76A0FF45BD0F048175FE6D07BC9DF3CE4A18B40

Function 00007FFDFAC5B340 Relevance: 5.2, APIs: 4, Instructions: 220COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFDFAC5B427
memcpy.VCRUNTIME140 ref: 00007FFDFAC5B47B
memcpy.VCRUNTIME140 ref: 00007FFDFAC5B4D7
memcpy.VCRUNTIME140 ref: 00007FFDFAC5B55B

Memory Dump Source

Source File: 00000001.00000002.1787290190.00007FFDFAC11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFDFAC10000, based on PE: true

Associated: 00000001.00000002.1787270770.00007FFDFAC10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787400841.00007FFDFAD3E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787438247.00007FFDFAD6B000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000001.00000002.1787459973.00007FFDFAD70000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffdfac10000_lz4wnSavmK.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 3f859ac6ac02e878cf440436bbbe9bcf4ba2bca3893d27bab73cb4c77d7d8bd1
Instruction ID: b16b3b2963936f5a7b42c702d44c4610bf9fed77a3b4113f91a12f2791d7dda5
Opcode Fuzzy Hash: 3f859ac6ac02e878cf440436bbbe9bcf4ba2bca3893d27bab73cb4c77d7d8bd1
Instruction Fuzzy Hash: B991A239B097468AEB6C9E16D164A6D7A94FB44BD0F584274EE6D077C9EF3CE4108700

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lz4wnSavmK.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_ARC4.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_Salsa20.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_chacha20.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_pkcs1_decode.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_aes.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_aesni.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_arc2.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_blowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cast.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cbc.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_cfb.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ctr.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_des.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_des3.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ecb.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_eksblowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ocb.pyd

C:\Users\user\AppData\Local\Temp\_MEI72522\Crypto\Cipher\_raw_ofb.pyd

Windows Analysis Report
lz4wnSavmK.exe