Edit tour

Windows Analysis Report
7EznMik8Fw.exe

Overview

General Information

Sample name:	7EznMik8Fw.exe renamed because original name is a hash value
Original sample name:	fc5586ca851cbf4eed21ae5c11b8e5d7c23379561016f779f5fe346439e2f55d.exe
Analysis ID:	1571343
MD5:	a02bd3671b7dab9f036b13c8b0339714
SHA1:	9c48e8a80a0cf0a1ca1e4328091241c242dfc5b4
SHA256:	fc5586ca851cbf4eed21ae5c11b8e5d7c23379561016f779f5fe346439e2f55d
Tags:	busquedasxurl-comexeuser-JAMESWT_MHT
Infos:

Detection

Python Stealer

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to infect the boot sector

Found pyInstaller with non standard icon

Yara detected Generic Python Stealer

Binary contains a suspicious time stamp

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to enumerate running services

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7EznMik8Fw.exe (PID: 4344 cmdline: "C:\Users\user\Desktop\7EznMik8Fw.exe" MD5: A02BD3671B7DAB9F036B13C8B0339714)

7EznMik8Fw.exe (PID: 4196 cmdline: "C:\Users\user\Desktop\7EznMik8Fw.exe" MD5: A02BD3671B7DAB9F036B13C8B0339714)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: 7EznMik8Fw.exe PID: 4196	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7EznMik8Fw.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 7EznMik8Fw.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93943420 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	2_2_00007FFD93943420
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E11BD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FFD938E11BD
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93929370 ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFD93929370
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1997 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FFD938E1997
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938ED2E1 CRYPTO_free,	2_2_00007FFD938ED2E1
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939312E0 ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,	2_2_00007FFD939312E0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9392D2F0 RAND_bytes_ex,CRYPTO_malloc,memset,	2_2_00007FFD9392D2F0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1992 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new_ex,OPENSSL_sk_num,X509_VERIFY_PARAM_new,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,	2_2_00007FFD938E1992
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1ED8 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD938E1ED8
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	2_2_00007FFD938E1ACD
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E144C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,	2_2_00007FFD938E144C
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E155A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FFD938E155A
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939252A0 CRYPTO_free,	2_2_00007FFD939252A0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E230B ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free,	2_2_00007FFD938E230B
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1483 CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD938E1483
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93943210 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	2_2_00007FFD93943210
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938EB200 CRYPTO_clear_free,	2_2_00007FFD938EB200
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E20EF CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFD938E20EF
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9394D170 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	2_2_00007FFD9394D170
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E111D CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	2_2_00007FFD938E111D
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93941126 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFD93941126
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938ED140 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD938ED140
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938EF060 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFD938EF060
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939310C0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFD939310C0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9390D0C0 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	2_2_00007FFD9390D0C0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9394B0D0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFD9394B0D0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E2121 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD938E2121
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1262 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FFD938E1262
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938EF7F0 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,	2_2_00007FFD938EF7F0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93949850 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD93949850
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E11DB EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FFD938E11DB
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E19E7 CRYPTO_free,	2_2_00007FFD938E19E7
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E162C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FFD938E162C
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93957820 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_new,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFD93957820
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1846 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,OPENSSL_sk_num,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,	2_2_00007FFD938E1846
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1582 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FFD938E1582
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93959790 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,	2_2_00007FFD93959790
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E108C ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFD938E108C
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93937770 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFD93937770
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F97B0 CRYPTO_free,CRYPTO_strdup,	2_2_00007FFD938F97B0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	2_2_00007FFD938E1087
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F7730 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FFD938F7730
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9390D750 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FFD9390D750
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E25D6 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	2_2_00007FFD938E25D6
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E2522 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD938E2522
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9393F660 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFD9393F660
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E176C CRYPTO_malloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	2_2_00007FFD938E176C
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939235E0 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	2_2_00007FFD939235E0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1646 EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,EVP_DigestVerify,ERR_new,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	2_2_00007FFD938E1646
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F14E0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FFD938F14E0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E12CB CRYPTO_THREAD_run_once,	2_2_00007FFD938E12CB
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93955540 CRYPTO_memcmp,	2_2_00007FFD93955540
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938EF540 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_derive_set_peer,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,	2_2_00007FFD938EF540
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9392F490 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD9392F490
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1023 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	2_2_00007FFD938E1023
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E193D CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD938E193D
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93913460 CRYPTO_malloc,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,ERR_set_debug,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFD93913460
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E267B CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FFD938E267B
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E23E7 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFD938E23E7
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E150F OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	2_2_00007FFD938E150F
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1CEE CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	2_2_00007FFD938E1CEE
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1361 CRYPTO_malloc,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,ERR_pop_to_mark,CRYPTO_free,EVP_PKEY_free,	2_2_00007FFD938E1361
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E5C53 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	2_2_00007FFD938E5C53
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9392DB60 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD9392DB60
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9394BB70 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFD9394BB70
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E222A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,	2_2_00007FFD938E222A
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93945B10 EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFD93945B10
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93905AE0 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD93905AE0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F5B10 COMP_zlib,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	2_2_00007FFD938F5B10
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9392DAF0 CRYPTO_free,	2_2_00007FFD9392DAF0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F3B30 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FFD938F3B30
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E13D9 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,	2_2_00007FFD938E13D9
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1C53 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FFD938E1C53
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E23EC CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	2_2_00007FFD938E23EC
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939059F0 CRYPTO_free,CRYPTO_free,	2_2_00007FFD939059F0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1A16 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FFD938E1A16
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F5A10 OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	2_2_00007FFD938F5A10
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93937A40 CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFD93937A40
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E271B CRYPTO_free,CRYPTO_strdup,	2_2_00007FFD938E271B
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E107D CRYPTO_free,	2_2_00007FFD938E107D
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F7980 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,strncmp,CRYPTO_free,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	2_2_00007FFD938F7980
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E204A CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFD938E204A
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD938E1B31
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9393F8F0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FFD9393F8F0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1D84 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFD938E1D84
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93905870 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD93905870
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E586A BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	2_2_00007FFD938E586A
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1B18 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_memcmp,ERR_new,ERR_new,	2_2_00007FFD938E1B18
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E2590 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FFD938E2590
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939438A0 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,	2_2_00007FFD939438A0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93914000 CRYPTO_realloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD93914000
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E103C CRYPTO_malloc,COMP_expand_block,	2_2_00007FFD938E103C
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9392E040 CRYPTO_free,	2_2_00007FFD9392E040
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1D8E EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_MAC_init,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free,	2_2_00007FFD938E1D8E
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1EDD CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFD938E1EDD
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93951F70 CRYPTO_memcmp,	2_2_00007FFD93951F70
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938EDFB2 ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,	2_2_00007FFD938EDFB2
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93959F10 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD93959F10
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1AC3 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	2_2_00007FFD938E1AC3
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E236F CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD938E236F
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E2027 CRYPTO_free,	2_2_00007FFD938E2027
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E24E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFD938E24E6
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93901E60 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	2_2_00007FFD93901E60
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E5E80 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	2_2_00007FFD938E5E80
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E3EB0 CRYPTO_free,	2_2_00007FFD938E3EB0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938FBEC0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFD938FBEC0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938EDEC0 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD938EDEC0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1CE9 memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FFD938E1CE9
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E16A4 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD938E16A4
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F5D80 CRYPTO_THREAD_run_once,	2_2_00007FFD938F5D80
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E15E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,memcpy,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD938E15E6
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93905CF0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,d2i_X509,X509_get0_pubkey,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD93905CF0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1F50 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FFD938E1F50
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93943D30 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FFD93943D30
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1CBC EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD938E1CBC
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1F37 CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FFD938E1F37
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93937CD0 CRYPTO_memcmp,	2_2_00007FFD93937CD0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E19DD BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	2_2_00007FFD938E19DD
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E139D memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	2_2_00007FFD938E139D
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93900380 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FFD93900380
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F43A0 OPENSSL_sk_num,X509_STORE_CTX_new_ex,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_new,ERR_set_debug,ERR_set_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	2_2_00007FFD938F43A0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E25EF CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_clear_free,	2_2_00007FFD938E25EF
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939522F0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFD939522F0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E4300 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD938E4300
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93938350 CRYPTO_free,CRYPTO_strndup,	2_2_00007FFD93938350
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E23D8 EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FFD938E23D8
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1B54 memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,memcpy,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFD938E1B54
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9392E260 CRYPTO_free,	2_2_00007FFD9392E260
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1401 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	2_2_00007FFD938E1401
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E2180 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FFD938E2180
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9395A2C0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,	2_2_00007FFD9395A2C0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9392E200 CRYPTO_free,	2_2_00007FFD9392E200
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F21F0 CRYPTO_THREAD_run_once,	2_2_00007FFD938F21F0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1389 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD938E1389
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938FE227 CRYPTO_THREAD_write_lock,	2_2_00007FFD938FE227
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93924230 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FFD93924230
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93922230 ERR_new,ERR_set_debug,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free,	2_2_00007FFD93922230
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E198D CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FFD938E198D
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939021C0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	2_2_00007FFD939021C0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93944110 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FFD93944110
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E24C8 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	2_2_00007FFD938E24C8
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E26DF BIO_s_file,BIO_new,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,strncmp,ERR_new,ERR_set_debug,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	2_2_00007FFD938E26DF
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1140 CRYPTO_free,	2_2_00007FFD938E1140
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFD938E1AB4
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9392E0C1 CRYPTO_free,CRYPTO_free,	2_2_00007FFD9392E0C1
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939380A0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FFD939380A0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,	2_2_00007FFD938E1893
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E136B ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD938E136B
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93954809 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD93954809
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F47F0 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	2_2_00007FFD938F47F0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93928810 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FFD93928810
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F4790 CRYPTO_get_ex_new_index,	2_2_00007FFD938F4790
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9395A770 BN_bin2bn,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FFD9395A770
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E17DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FFD938E17DF
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93940700 ERR_new,ERR_set_debug,CRYPTO_clear_free,	2_2_00007FFD93940700
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939466E0 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FFD939466E0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939526E0 CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_fetch,EVP_CIPHER_get_iv_length,RAND_bytes_ex,EVP_CIPHER_free,EVP_EncryptUpdate,EVP_EncryptFinal,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get_iv_length,ERR_new,ERR_new,CRYPTO_free,EVP_CIPHER_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_CIPHER_CTX_free,	2_2_00007FFD939526E0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1CA3 CRYPTO_strdup,CRYPTO_free,	2_2_00007FFD938E1CA3
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1771 CRYPTO_free,	2_2_00007FFD938E1771
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E22D4 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	2_2_00007FFD938E22D4
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93906758 CRYPTO_malloc,ERR_new,ERR_set_debug,CRYPTO_clear_free,OPENSSL_LH_num_items,OPENSSL_LH_num_items,	2_2_00007FFD93906758
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E17E9 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFD938E17E9
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E14CE CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FFD938E14CE
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939286D0 OPENSSL_cleanse,CRYPTO_free,	2_2_00007FFD939286D0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E26AD ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FFD938E26AD
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9390E5E0 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FFD9390E5E0

Source: 7EznMik8Fw.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2137179563.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: ucrtbase.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3407592347.00007FFDA3495000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136885594.00000231371E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: 7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: 7EznMik8Fw.exe, 00000002.00000002.3403076331.00007FFD93D59000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb source: win32api.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 7EznMik8Fw.exe, 00000000.00000003.2134345969.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3409004585.00007FFDA54F3000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: 7EznMik8Fw.exe, 00000002.00000002.3405240890.00007FFD9DB60000.00000002.00000001.01000000.0000001E.sdmp, pywintypes312.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2137495911.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2134498631.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3407986191.00007FFDA3FD5000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3405240890.00007FFD9DB60000.00000002.00000001.01000000.0000001E.sdmp, pywintypes312.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3408370227.00007FFDA4341000.00000002.00000001.01000000.00000008.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3406579379.00007FFDA32F7000.00000002.00000001.01000000.00000017.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136972048.00000231371E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32crypt.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3405441960.00007FFD9DED1000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136688085.00000231371E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3407707848.00007FFDA3A88000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2137037925.00000231371EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3406691510.00007FFDA3332000.00000002.00000001.01000000.00000016.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3407437647.00007FFDA33CC000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3408082976.00007FFDA416D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: ucrtbase.pdbUGP source: 7EznMik8Fw.exe, 00000002.00000002.3407592347.00007FFDA3495000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3407816302.00007FFDA3AE9000.00000002.00000001.01000000.0000000D.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: 7EznMik8Fw.exe, 00000000.00000003.2134498631.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3407986191.00007FFDA3FD5000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: X509_SIGPKCS8_encrypt_excrypto\pkcs12\p12_p8e.cPKCS8_set0_pbe_excompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: 7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3403635102.00007FFD942B4000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2137382808.00000231371E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3402126884.00007FFD938CF000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: 7EznMik8Fw.exe, 00000002.00000002.3403076331.00007FFD93DF1000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: 7EznMik8Fw.exe, 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3408592458.00007FFDA46D6000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136788028.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2134345969.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3409004585.00007FFDA54F3000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3402002576.00007FFD9377C000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3403076331.00007FFD93DF1000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3408809556.00007FFDA5493000.00000002.00000001.01000000.0000000E.sdmp, select.pyd.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb!! source: win32api.pyd.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2137279314.00000231371E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3407437647.00007FFDA33CC000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: crypto\stack\stack.cOPENSSL_sk_dupOPENSSL_sk_deep_copysk_reserveOPENSSL_sk_new_reserveOPENSSL_sk_reserveOPENSSL_sk_insertOPENSSL_sk_seti=%dcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC3.1.4built on: Fri Nov 24 00:12:45 2023 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptoOPENSSL_atexitcrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: 7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32crypt.pdb!! source: 7EznMik8Fw.exe, 00000002.00000002.3405441960.00007FFD9DED1000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3408703644.00007FFDA4DA3000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-7t032bmh\src\rust\target\release\deps\cryptography_rust.pdbcQ source: 7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-7t032bmh\src\rust\target\release\deps\cryptography_rust.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3408904961.00007FFDA54B4000.00000002.00000001.01000000.0000000C.sdmp, _wmi.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3408904961.00007FFDA54B4000.00000002.00000001.01000000.0000000C.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3406460673.00007FFDA2E9F000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3397430893.00000276F9CD0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3407293756.00007FFDA335D000.00000002.00000001.01000000.00000011.sdmp, _ssl.pyd.0.dr

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E97E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF682E97E4C
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E888D0 FindFirstFileExW,FindClose,	0_2_00007FF682E888D0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EA1EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF682EA1EE4
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E97E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF682E97E4C

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 2_2_00007FFD93632E70 memset,PyList_New,SetErrorMode,PyArg_ParseTuple,PyObject_IsTrue,PyEval_SaveThread,GetLogicalDriveStringsA,PyEval_RestoreThread,PyErr_SetFromWindowsErr,SetErrorMode,PyEval_SaveThread,GetDriveTypeA,PyEval_RestoreThread,GetVolumeInformationA,strcat_s,SetLastError,strcat_s,strcat_s,strcat_s,FindFirstVolumeMountPointA,strcpy_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,FindNextVolumeMountPointA,FindVolumeMountPointClose,strcat_s,strcat_s,Py_BuildValue,PyList_Append,_Py_Dealloc,strchr,SetErrorMode,FindVolumeMountPointClose,SetErrorMode,_Py_Dealloc,_Py_Dealloc,

2_2_00007FFD93632E70

Source: Joe Sandbox View

IP Address: 34.224.200.202 34.224.200.202

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: httpbin.org

Source: 7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: 7EznMik8Fw.exe, 00000002.00000002.3398809969.00000276FA960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/vcpython27
Source: 7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFBB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172635006.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyusering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136654969.00000231371F4000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136654969.00000231371F4000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397548789.00000276F9F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: 7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB04A000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA2B1000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB0EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA2B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlx
Source: 7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl4/
Source: 7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlyA
Source: 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crlt
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB0EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB04A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136654969.00000231371F4000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.cr
Source: _hashlib.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172635006.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: 7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFBB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: 7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA56F000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3400306980.00000276FB9C0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3400184149.00000276FB8C0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3400184149.00000276FB95C000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172635006.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: 7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: 7EznMik8Fw.exe, 00000002.00000002.3398945430.00000276FABC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: 7EznMik8Fw.exe, 00000002.00000002.3398945430.00000276FABC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: 7EznMik8Fw.exe, 00000002.00000002.3399038264.00000276FACC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: 7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2168303500.00000276FA330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/unittest.html
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: 7EznMik8Fw.exe, 00000002.00000002.3400184149.00000276FB8F0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl.
Source: 7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA5F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA56F000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA56F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397548789.00000276F9E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: 7EznMik8Fw.exe, 00000002.00000002.3400306980.00000276FBA8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136654969.00000231371F4000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136654969.00000231371F4000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 7EznMik8Fw.exe, 00000002.00000002.3399038264.00000276FACC0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA56F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA56F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/N
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/per
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA56F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/yy
Source: 7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFBB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172635006.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: 7EznMik8Fw.exe, 00000002.00000002.3400184149.00000276FB8F0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3400306980.00000276FB9C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172635006.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: 7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB0EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: 7EznMik8Fw.exe, 00000002.00000002.3398945430.00000276FABC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA5AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/may
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _wmi.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA415000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB0EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA2B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: 7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172635006.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA5AF000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA5AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: 7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/botz
Source: 7EznMik8Fw.exe, 00000002.00000002.3397836333.00000276FA120000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3398543024.00000276FA620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: 7EznMik8Fw.exe, 00000002.00000002.3399038264.00000276FACC0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://busquedasxurl.com/login/conexion/bloqueadoreslogs.php?ip=
Source: 7EznMik8Fw.exe, 00000002.00000002.3399038264.00000276FACC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://busquedasxurl.com/login/conexion/bloqueadoreslogs.php?ip=yy
Source: 7EznMik8Fw.exe, 00000002.00000002.3400184149.00000276FB8F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://busquedasxurl.com/login/conexion/recibidor.php
Source: 7EznMik8Fw.exe, 00000002.00000002.3405122309.00007FFD9DA3D000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: METADATA.0.dr	String found in binary or memory: https://cryptography.io
Source: METADATA.0.dr	String found in binary or memory: https://cryptography.io/
Source: METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: 7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: 7EznMik8Fw.exe, 00000002.00000002.3397548789.00000276F9F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: 7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/socket.html#socket.socket.connect_ex
Source: 7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: 7EznMik8Fw.exe, 00000002.00000002.3399995307.00000276FB6C0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: 7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: 7EznMik8Fw.exe, 00000002.00000003.2160128430.00000276F99C1000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F9990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: 7EznMik8Fw.exe, 00000002.00000002.3400510290.00000276FBB74000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB03A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: 7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: 7EznMik8Fw.exe, 00000000.00000002.3396823044.00000231371F4000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3405282264.00007FFD9DB71000.00000002.00000001.01000000.0000001E.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3405492476.00007FFD9DEDE000.00000002.00000001.01000000.0000001D.sdmp, win32api.pyd.0.dr, pywintypes312.dll.0.dr	String found in binary or memory: https://github.com/mhammond/pywin32
Source: 7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography
Source: METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/
Source: METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: 7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: 7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: 7EznMik8Fw.exe, 00000002.00000002.3398543024.00000276FA620000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2168303500.00000276FA2AF000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA2A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: 7EznMik8Fw.exe, 00000002.00000002.3397454008.00000276F9D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: 7EznMik8Fw.exe, 00000002.00000002.3397104151.00000276F98FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: 7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F9990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: 7EznMik8Fw.exe, 00000002.00000003.2160128430.00000276F99C1000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F9990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: 7EznMik8Fw.exe, 00000002.00000003.2162778218.00000276F9F8C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2162306851.00000276F9F54000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397548789.00000276F9F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: 7EznMik8Fw.exe, 00000002.00000002.3398543024.00000276FA620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/issues/396
Source: 7EznMik8Fw.exe, 00000002.00000003.2160128430.00000276F99C1000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F9990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: 7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: 7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: 7EznMik8Fw.exe, 00000002.00000002.3399995307.00000276FB6C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: 7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F9990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: 7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F9990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: 7EznMik8Fw.exe, 00000002.00000002.3400184149.00000276FB8C0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA56F000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFB0000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA2B1000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA2A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: 7EznMik8Fw.exe, 00000002.00000002.3400510290.00000276FBC0C000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: 7EznMik8Fw.exe, 00000002.00000002.3397836333.00000276FA120000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397548789.00000276F9F32000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2168303500.00000276FA330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: 7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFBB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: METADATA.0.dr	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: 7EznMik8Fw.exe, 00000002.00000002.3398721697.00000276FA850000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: 7EznMik8Fw.exe, 00000002.00000002.3398809969.00000276FA960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: 7EznMik8Fw.exe, 00000002.00000002.3397548789.00000276F9F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
Source: 7EznMik8Fw.exe, 00000002.00000002.3398721697.00000276FA850000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: 7EznMik8Fw.exe, 00000002.00000002.3397836333.00000276FA120000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3398543024.00000276FA620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: 7EznMik8Fw.exe, 00000002.00000002.3397753587.00000276FA020000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: 7EznMik8Fw.exe, 00000002.00000002.3403635102.00007FFD942B4000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: 7EznMik8Fw.exe, 00000002.00000002.3398809969.00000276FA960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0685/
Source: 7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: METADATA.0.dr	String found in binary or memory: https://pypi.org/project/cryptography/
Source: METADATA.0.dr	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: 7EznMik8Fw.exe, 00000002.00000002.3399995307.00000276FB6C0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: 7EznMik8Fw.exe, 00000002.00000002.3400184149.00000276FB8F0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: 7EznMik8Fw.exe, 00000002.00000002.3398721697.00000276FA850000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: 7EznMik8Fw.exe, 00000002.00000002.3397548789.00000276F9F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: 7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB04A000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3400510290.00000276FBB74000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB03A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: 7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F9990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: 7EznMik8Fw.exe, 00000002.00000002.3398543024.00000276FA620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://upload.pypi.org/legacy/
Source: 7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: 7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyP
Source: 7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: 7EznMik8Fw.exe, 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3403354235.00007FFD93E9A000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: 7EznMik8Fw.exe, 00000002.00000002.3397104151.00000276F9880000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2160714646.00000276F9A14000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: 7EznMik8Fw.exe, 00000002.00000002.3404019248.00007FFD9442C000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: 7EznMik8Fw.exe, 00000002.00000002.3403635102.00007FFD942B4000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: 7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93631E90 PyList_New,GetActiveProcessorCount,PyErr_SetFromWindowsErr,_Py_Dealloc,free,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,PyExc_RuntimeError,PyErr_SetString,malloc,PyErr_NoMemory,NtQuerySystemInformation,Py_BuildValue,PyList_Append,_Py_Dealloc,free,_Py_Dealloc,	2_2_00007FFD93631E90
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93636AA0 OpenProcess,GetLastError,NtQueryInformationProcess,RtlNtStatusToDosErrorNoTeb,PyErr_SetFromWindowsErrWithFilename,CloseHandle,ReadProcessMemory,GetLastError,CloseHandle,ReadProcessMemory,NtQueryInformationProcess,CloseHandle,ReadProcessMemory,ReadProcessMemory,VirtualQueryEx,GetLastError,PyErr_SetFromWindowsErrWithFilename,CloseHandle,calloc,PyErr_NoMemory,CloseHandle,ReadProcessMemory,GetLastError,CloseHandle,free,CloseHandle,	2_2_00007FFD93636AA0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93632480 GetActiveProcessorCount,PyErr_SetFromWindowsErr,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,PyExc_RuntimeError,PyErr_SetString,malloc,PyErr_NoMemory,NtQuerySystemInformation,free,malloc,PyErr_NoMemory,NtQuerySystemInformation,malloc,PyErr_NoMemory,NtQuerySystemInformation,free,free,free,free,free,Py_BuildValue,	2_2_00007FFD93632480
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93634680 PyArg_ParseTuple,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,Py_BuildValue,PyUnicode_FromWideChar,GetProcessHeap,HeapFree,PyErr_NoMemory,	2_2_00007FFD93634680
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93634A70 PyArg_ParseTuple,OpenProcess,GetLastError,GetProcessHeap,HeapAlloc,NtQueryVirtualMemory,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQueryVirtualMemory,PyExc_RuntimeError,PyErr_SetString,CloseHandle,PyErr_Clear,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,HeapFree,CloseHandle,Py_BuildValue,PyErr_NoMemory,CloseHandle,	2_2_00007FFD93634A70
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93636250 GetProcessHeap,HeapAlloc,GetFileType,SetLastError,NtQueryObject,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,PyErr_NoMemory,GetProcessHeap,HeapFree,	2_2_00007FFD93636250
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93636E40 PyExc_RuntimeError,PyErr_SetString,OpenProcess,GetLastError,NtQueryInformationProcess,CloseHandle,CloseHandle,calloc,PyErr_NoMemory,CloseHandle,NtQueryInformationProcess,calloc,PyErr_NoMemory,free,CloseHandle,wcscpy_s,free,CloseHandle,	2_2_00007FFD93636E40
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93635720 PyArg_ParseTuple,OpenProcess,GetLastError,NtQueryInformationProcess,CloseHandle,Py_BuildValue,	2_2_00007FFD93635720
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93635810 PyArg_ParseTuple,OpenProcess,GetLastError,NtSetInformationProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,	2_2_00007FFD93635810
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93634D00 PyArg_ParseTuple,OpenProcess,GetLastError,PyObject_IsTrue,NtSuspendProcess,NtResumeProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,	2_2_00007FFD93634D00
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93636600 PyList_New,EnterCriticalSection,GetProcessHeap,HeapAlloc,PyErr_NoMemory,_Py_Dealloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,NtQuerySystemInformation,GetProcessHeap,HeapFree,PyExc_RuntimeError,PyErr_SetString,GetCurrentProcess,DuplicateHandle,PyUnicode_FromWideChar,PyList_Append,_Py_Dealloc,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,_Py_Dealloc,GetProcessHeap,HeapFree,LeaveCriticalSection,	2_2_00007FFD93636600
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936373F0 malloc,NtQuerySystemInformation,free,malloc,PyErr_NoMemory,free,free,	2_2_00007FFD936373F0

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 2_2_00007FFD93632B00: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle,

2_2_00007FFD93632B00

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EA6370	0_2_00007FF682EA6370
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E87950	0_2_00007FF682E87950
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EA72BC	0_2_00007FF682EA72BC
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E9A430	0_2_00007FF682E9A430
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E9E4B0	0_2_00007FF682E9E4B0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E97C98	0_2_00007FF682E97C98
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E91C90	0_2_00007FF682E91C90
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E9EB30	0_2_00007FF682E9EB30
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E93AE4	0_2_00007FF682E93AE4
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E922A4	0_2_00007FF682E922A4
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EA0F38	0_2_00007FF682EA0F38
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EA4280	0_2_00007FF682EA4280
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E91A84	0_2_00007FF682E91A84
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E9E01C	0_2_00007FF682E9E01C
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EA9FF8	0_2_00007FF682EA9FF8
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E88FD0	0_2_00007FF682E88FD0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E97E4C	0_2_00007FF682E97E4C
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E81F50	0_2_00007FF682E81F50
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EA0F38	0_2_00007FF682EA0F38
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E920A0	0_2_00007FF682E920A0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E91880	0_2_00007FF682E91880
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EA65EC	0_2_00007FF682EA65EC
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EA6D70	0_2_00007FF682EA6D70
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E92D50	0_2_00007FF682E92D50
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E95F30	0_2_00007FF682E95F30
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EA471C	0_2_00007FF682EA471C
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E936E0	0_2_00007FF682E936E0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EA1EE4	0_2_00007FF682EA1EE4
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E986D0	0_2_00007FF682E986D0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E91E94	0_2_00007FF682E91E94
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E97E4C	0_2_00007FF682E97E4C
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93631E90	2_2_00007FFD93631E90
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936399D0	2_2_00007FFD936399D0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93633990	2_2_00007FFD93633990
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93632E70	2_2_00007FFD93632E70
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93638F30	2_2_00007FFD93638F30
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93632B00	2_2_00007FFD93632B00
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93636600	2_2_00007FFD93636600
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93634DF0	2_2_00007FFD93634DF0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936B33B0	2_2_00007FFD936B33B0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93704410	2_2_00007FFD93704410
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936772D0	2_2_00007FFD936772D0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93653295	2_2_00007FFD93653295
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936EA280	2_2_00007FFD936EA280
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936F4330	2_2_00007FFD936F4330
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936D8310	2_2_00007FFD936D8310
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936762F0	2_2_00007FFD936762F0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936B11D0	2_2_00007FFD936B11D0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD937051C0	2_2_00007FFD937051C0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9369F230	2_2_00007FFD9369F230
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD937110E0	2_2_00007FFD937110E0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936540B0	2_2_00007FFD936540B0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD937020B0	2_2_00007FFD937020B0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93669060	2_2_00007FFD93669060
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93661060	2_2_00007FFD93661060
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936CB060	2_2_00007FFD936CB060
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936BA110	2_2_00007FFD936BA110
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9369F7D0	2_2_00007FFD9369F7D0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936577C4	2_2_00007FFD936577C4
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9367D7C0	2_2_00007FFD9367D7C0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936547C0	2_2_00007FFD936547C0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936F27A0	2_2_00007FFD936F27A0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93680790	2_2_00007FFD93680790
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93706780	2_2_00007FFD93706780
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9369A770	2_2_00007FFD9369A770
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9365282E	2_2_00007FFD9365282E
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9366C800	2_2_00007FFD9366C800
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936F76C0	2_2_00007FFD936F76C0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936F4750	2_2_00007FFD936F4750
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936D6700	2_2_00007FFD936D6700
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936666F0	2_2_00007FFD936666F0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936F35D0	2_2_00007FFD936F35D0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936F85B0	2_2_00007FFD936F85B0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93694590	2_2_00007FFD93694590
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936C2580	2_2_00007FFD936C2580
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93659640	2_2_00007FFD93659640
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93671630	2_2_00007FFD93671630
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9367E4D0	2_2_00007FFD9367E4D0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936574B1	2_2_00007FFD936574B1
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93663490	2_2_00007FFD93663490
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936AA490	2_2_00007FFD936AA490
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9367C530	2_2_00007FFD9367C530
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936AB530	2_2_00007FFD936AB530
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93654510	2_2_00007FFD93654510
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93653BC0	2_2_00007FFD93653BC0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936D2BB0	2_2_00007FFD936D2BB0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93693BA0	2_2_00007FFD93693BA0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9368BB91	2_2_00007FFD9368BB91
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936DBAD0	2_2_00007FFD936DBAD0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93669AB0	2_2_00007FFD93669AB0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93696B40	2_2_00007FFD93696B40
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936DFB30	2_2_00007FFD936DFB30
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936D8B10	2_2_00007FFD936D8B10
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936E5B00	2_2_00007FFD936E5B00
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936C099B	2_2_00007FFD936C099B
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93673980	2_2_00007FFD93673980
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93685960	2_2_00007FFD93685960
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936B5A40	2_2_00007FFD936B5A40
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD937059E0	2_2_00007FFD937059E0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936C58A0	2_2_00007FFD936C58A0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936FC870	2_2_00007FFD936FC870
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9365A940	2_2_00007FFD9365A940
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93707920	2_2_00007FFD93707920
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936FE8E0	2_2_00007FFD936FE8E0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936AEFB0	2_2_00007FFD936AEFB0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9366BFA0	2_2_00007FFD9366BFA0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93667F60	2_2_00007FFD93667F60
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93657030	2_2_00007FFD93657030
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93699010	2_2_00007FFD93699010
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9367CFE0	2_2_00007FFD9367CFE0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936BAE70	2_2_00007FFD936BAE70
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936E5EF0	2_2_00007FFD936E5EF0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9365BDA0	2_2_00007FFD9365BDA0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD936A9D80	2_2_00007FFD936A9D80
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9366CDE0	2_2_00007FFD9366CDE0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93678CB0	2_2_00007FFD93678CB0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93659C80	2_2_00007FFD93659C80
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9365FC70	2_2_00007FFD9365FC70
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD937C12F0	2_2_00007FFD937C12F0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD937C18A0	2_2_00007FFD937C18A0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93929370	2_2_00007FFD93929370
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1FD7	2_2_00007FFD938E1FD7
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9392D2F0	2_2_00007FFD9392D2F0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E155A	2_2_00007FFD938E155A
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938F70B0	2_2_00007FFD938F70B0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93925770	2_2_00007FFD93925770
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9392D7C0	2_2_00007FFD9392D7C0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9390B700	2_2_00007FFD9390B700
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1AD7	2_2_00007FFD938E1AD7
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93959B30	2_2_00007FFD93959B30
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E21DF	2_2_00007FFD938E21DF
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1596	2_2_00007FFD938E1596
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1546	2_2_00007FFD938E1546
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1D8E	2_2_00007FFD938E1D8E
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1EDD	2_2_00007FFD938E1EDD
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93905CF0	2_2_00007FFD93905CF0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1CBC	2_2_00007FFD938E1CBC
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939183F0	2_2_00007FFD939183F0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E1B54	2_2_00007FFD938E1B54
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E116D	2_2_00007FFD938E116D
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD939526E0	2_2_00007FFD939526E0

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: String function: 00007FF682E82B30 appears 47 times
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: String function: 00007FFD9395C181 appears 786 times
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: String function: 00007FFD936594B0 appears 134 times
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: String function: 00007FFD9395C16F appears 233 times
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: String function: 00007FFD9395C265 appears 37 times
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: String function: 00007FFD93680F90 appears 34 times
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: String function: 00007FFD93631070 appears 43 times
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: String function: 00007FFD93631D70 appears 39 times
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: String function: 00007FFD9365A550 appears 171 times
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: String function: 00007FFD938E1325 appears 337 times

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: python3.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found

Source: 7EznMik8Fw.exe, 00000000.00000003.2135413913.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2137037925.00000231371EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2137179563.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000002.3396823044.00000231371F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2134345969.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2134498631.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2137279314.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2136972048.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2137382808.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2135243184.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2137459294.00000231371EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2136885594.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2136414995.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2136247673.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2136788028.00000231371E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000000.00000003.2136654969.00000231371EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe	Binary or memory string: OriginalFilename vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3407494927.00007FFDA33D5000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3406508488.00007FFDA2EAB000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3408026488.00007FFDA3FD9000.00000002.00000001.01000000.0000001F.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3402374532.00007FFD938D4000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3408418883.00007FFDA434E000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3408638426.00007FFDA46DB000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3408847243.00007FFDA5496000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3408128928.00007FFDA4172000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3407643722.00007FFDA34D2000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3407376604.00007FFDA3379000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3408746233.00007FFDA4DA6000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3403354235.00007FFD93E9A000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3409044324.00007FFDA54F9000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3407033350.00007FFDA333D000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3408940690.00007FFDA54B7000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3406623848.00007FFDA32FE000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3407854960.00007FFDA3AF3000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3397430893.00000276F9CD0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3405282264.00007FFD9DB71000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: OriginalFilenamepywintypes312.dll0 vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3402061018.00007FFD937AF000.00000002.00000001.01000000.0000001C.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3404368204.00007FFD94555000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3405492476.00007FFD9DEDE000.00000002.00000001.01000000.0000001D.sdmp	Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs 7EznMik8Fw.exe
Source: 7EznMik8Fw.exe, 00000002.00000002.3407748486.00007FFDA3A8F000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs 7EznMik8Fw.exe

Source: classification engine

Classification label: mal72.troj.evad.winEXE@3/122@1/1

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 0_2_00007FF682E88560 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF682E88560

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 2_2_00007FFD93637DB0 GetCurrentProcess,OpenProcessToken,GetLastError,ImpersonateSelf,OpenProcessToken,GetLastError,PyErr_SetFromWindowsErrWithFilename,LookupPrivilegeValueA,GetLastError,PyErr_SetFromWindowsErrWithFilename,AdjustTokenPrivileges,GetLastError,PyErr_SetFromWindowsErrWithFilename,AdjustTokenPrivileges,RevertToSelf,CloseHandle,

2_2_00007FFD93637DB0

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 2_2_00007FFD93632A30 PyArg_ParseTuple,PyUnicode_AsWideCharString,PyEval_SaveThread,GetDiskFreeSpaceExW,PyEval_RestoreThread,PyMem_Free,PyExc_OSError,PyErr_SetExcFromWindowsErrWithFilenameObject,Py_BuildValue,

2_2_00007FFD93632A30

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 2_2_00007FFD9363601F PyDict_New,memset,CreateToolhelp32Snapshot,PyErr_SetFromWindowsErr,_Py_Dealloc,Process32First,PyLong_FromLong,PyLong_FromLong,PyDict_SetItem,_Py_Dealloc,_Py_Dealloc,Process32Next,CloseHandle,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseHandle,

2_2_00007FFD9363601F

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 2_2_00007FFD93638AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,

2_2_00007FFD93638AA0

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI43442

Jump to behavior

Source: 7EznMik8Fw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7EznMik8Fw.exe, 00000002.00000002.3402002576.00007FFD9377C000.00000002.00000001.01000000.0000001C.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 7EznMik8Fw.exe, 00000002.00000002.3402002576.00007FFD9377C000.00000002.00000001.01000000.0000001C.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 7EznMik8Fw.exe, 00000002.00000002.3402002576.00007FFD9377C000.00000002.00000001.01000000.0000001C.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 7EznMik8Fw.exe, 00000002.00000002.3402002576.00007FFD9377C000.00000002.00000001.01000000.0000001C.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 7EznMik8Fw.exe, 7EznMik8Fw.exe, 00000002.00000002.3402002576.00007FFD9377C000.00000002.00000001.01000000.0000001C.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 7EznMik8Fw.exe, 00000002.00000002.3402002576.00007FFD9377C000.00000002.00000001.01000000.0000001C.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 7EznMik8Fw.exe, 00000002.00000002.3402002576.00007FFD9377C000.00000002.00000001.01000000.0000001C.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: 7EznMik8Fw.exe

ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

File read: C:\Users\user\Desktop\7EznMik8Fw.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7EznMik8Fw.exe "C:\Users\user\Desktop\7EznMik8Fw.exe"
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Process created: C:\Users\user\Desktop\7EznMik8Fw.exe "C:\Users\user\Desktop\7EznMik8Fw.exe"
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Process created: C:\Users\user\Desktop\7EznMik8Fw.exe "C:\Users\user\Desktop\7EznMik8Fw.exe"	Jump to behavior

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: pywintypes312.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: 7EznMik8Fw.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 7EznMik8Fw.exe

Static file information: File size 17524998 > 1048576

Source: 7EznMik8Fw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 7EznMik8Fw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 7EznMik8Fw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 7EznMik8Fw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 7EznMik8Fw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 7EznMik8Fw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 7EznMik8Fw.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 7EznMik8Fw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2137179563.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: ucrtbase.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3407592347.00007FFDA3495000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136885594.00000231371E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: 7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: 7EznMik8Fw.exe, 00000002.00000002.3403076331.00007FFD93D59000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb source: win32api.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 7EznMik8Fw.exe, 00000000.00000003.2134345969.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3409004585.00007FFDA54F3000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: 7EznMik8Fw.exe, 00000002.00000002.3405240890.00007FFD9DB60000.00000002.00000001.01000000.0000001E.sdmp, pywintypes312.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2135841119.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2137495911.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2134498631.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3407986191.00007FFDA3FD5000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3405240890.00007FFD9DB60000.00000002.00000001.01000000.0000001E.sdmp, pywintypes312.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3408370227.00007FFDA4341000.00000002.00000001.01000000.00000008.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2135587857.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3406579379.00007FFDA32F7000.00000002.00000001.01000000.00000017.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136972048.00000231371E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32crypt.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3405441960.00007FFD9DED1000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136688085.00000231371E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2134600948.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3407707848.00007FFDA3A88000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2137037925.00000231371EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3406691510.00007FFDA3332000.00000002.00000001.01000000.00000016.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3407437647.00007FFDA33CC000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2134732279.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3408082976.00007FFDA416D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: ucrtbase.pdbUGP source: 7EznMik8Fw.exe, 00000002.00000002.3407592347.00007FFDA3495000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136114206.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3407816302.00007FFDA3AE9000.00000002.00000001.01000000.0000000D.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: 7EznMik8Fw.exe, 00000000.00000003.2134498631.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3407986191.00007FFDA3FD5000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: X509_SIGPKCS8_encrypt_excrypto\pkcs12\p12_p8e.cPKCS8_set0_pbe_excompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: 7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3403635102.00007FFD942B4000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2137382808.00000231371E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3402126884.00007FFD938CF000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: 7EznMik8Fw.exe, 00000002.00000002.3403076331.00007FFD93DF1000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: 7EznMik8Fw.exe, 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2135930497.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3408592458.00007FFDA46D6000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136788028.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2134345969.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3409004585.00007FFDA54F3000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3402002576.00007FFD9377C000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3403076331.00007FFD93DF1000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3408809556.00007FFDA5493000.00000002.00000001.01000000.0000000E.sdmp, select.pyd.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb!! source: win32api.pyd.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2137279314.00000231371E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 7EznMik8Fw.exe, 00000000.00000003.2135711838.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3407437647.00007FFDA33CC000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: crypto\stack\stack.cOPENSSL_sk_dupOPENSSL_sk_deep_copysk_reserveOPENSSL_sk_new_reserveOPENSSL_sk_reserveOPENSSL_sk_insertOPENSSL_sk_seti=%dcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC3.1.4built on: Fri Nov 24 00:12:45 2023 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptoOPENSSL_atexitcrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: 7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32crypt.pdb!! source: 7EznMik8Fw.exe, 00000002.00000002.3405441960.00007FFD9DED1000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136028430.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3408703644.00007FFDA4DA3000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-7t032bmh\src\rust\target\release\deps\cryptography_rust.pdbcQ source: 7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-7t032bmh\src\rust\target\release\deps\cryptography_rust.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3408904961.00007FFDA54B4000.00000002.00000001.01000000.0000000C.sdmp, _wmi.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: 7EznMik8Fw.exe, 00000000.00000003.2136577351.00000231371E7000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3408904961.00007FFDA54B4000.00000002.00000001.01000000.0000000C.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3406460673.00007FFDA2E9F000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3397430893.00000276F9CD0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: 7EznMik8Fw.exe, 00000002.00000002.3407293756.00007FFDA335D000.00000002.00000001.01000000.00000011.sdmp, _ssl.pyd.0.dr

Source: 7EznMik8Fw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 7EznMik8Fw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 7EznMik8Fw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 7EznMik8Fw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 7EznMik8Fw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: api-ms-win-crt-process-l1-1-0.dll.0.dr

Static PE information: 0xA8F275DA [Mon Oct 27 06:36:10 2059 UTC]

Source: 7EznMik8Fw.exe	Static PE information: section name: _RDATA
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EC5004 push rsp; retf	0_2_00007FF682EC5005
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9369161E push rdx; iretd	2_2_00007FFD93691621
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD93904021 push rcx; ret	2_2_00007FFD93904022

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, \\.\PhysicalDrive%d	2_2_00007FFD93632B00
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, PhysicalDrive%i	2_2_00007FFD93632B00
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i	2_2_00007FFD93632B00
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i	2_2_00007FFD93632B00

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Process created: "C:\Users\user\Desktop\7EznMik8Fw.exe"

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI43442\_bz2.pyd	Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, \\.\PhysicalDrive%d	2_2_00007FFD93632B00
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, PhysicalDrive%i	2_2_00007FFD93632B00
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i	2_2_00007FFD93632B00
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: PyDict_New,swprintf_s,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,swprintf_s,Py_BuildValue,PyDict_SetItemString,_Py_Dealloc,CloseHandle,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,__acrt_iob_func,fprintf,GetLastError,__acrt_iob_func,fprintf,__acrt_iob_func,PyErr_SetFromWindowsErr,_Py_Dealloc,_Py_Dealloc,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i	2_2_00007FFD93632B00

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 2_2_00007FFD93638AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,

2_2_00007FFD93638AA0

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 0_2_00007FF682E851E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF682E851E0

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: PyList_New,OpenSCManagerA,GetLastError,PyErr_SetFromWindowsErrWithFilename,EnumServicesStatusExW,GetLastError,free,malloc,EnumServicesStatusExW,PyUnicode_FromWideChar,PyUnicode_FromWideChar,Py_BuildValue,PyList_Append,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseServiceHandle,free,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,CloseServiceHandle,free,

2_2_00007FFD93638170

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI43442\_bz2.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-16314

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

API coverage: 1.5 %

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E97E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF682E97E4C
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E888D0 FindFirstFileExW,FindClose,	0_2_00007FF682E888D0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682EA1EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF682EA1EE4
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E97E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF682E97E4C

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

2_2_00007FFD93632E70

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 2_2_00007FFD936318C0 PyModule_Create2,getenv,RtlGetVersion,GetSystemInfo,InitializeCriticalSection,PyModule_GetState,PyErr_NewException,_Py_Dealloc,PyErr_NewException,PyModule_AddObject,PyErr_NewException,PyModule_AddObject,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,

2_2_00007FFD936318C0

Source: 7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F99DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWv
Source: cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 0_2_00007FF682E9ABD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF682E9ABD8

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 0_2_00007FF682EA3AF0 GetProcessHeap,

0_2_00007FF682EA3AF0

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E9ABD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF682E9ABD8
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E8BCE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF682E8BCE0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E8C760 SetUnhandledExceptionFilter,	0_2_00007FF682E8C760
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 0_2_00007FF682E8C57C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF682E8C57C
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9363A978 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD9363A978
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9363A050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD9363A050
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD9377ABE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD9377ABE0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD937C2AA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD937C2AA0
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD937C3068 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD937C3068
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Code function: 2_2_00007FFD938E2126 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD938E2126

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Process created: C:\Users\user\Desktop\7EznMik8Fw.exe "C:\Users\user\Desktop\7EznMik8Fw.exe"

Jump to behavior

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 0_2_00007FF682EA9E40 cpuid

0_2_00007FF682EA9E40

Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\_wmi.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\_asyncio.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\_overlapped.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI43442\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7EznMik8Fw.exe	Queries volume information: C:\Users\user\Desktop\7EznMik8Fw.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 0_2_00007FF682E8C460 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF682E8C460

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

Code function: 0_2_00007FF682EA6370 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF682EA6370

Source: C:\Users\user\Desktop\7EznMik8Fw.exe

2_2_00007FFD936318C0

Stealing of Sensitive Information

Yara detected Generic Python Stealer

Source: Yara match

File source: Process Memory Space: 7EznMik8Fw.exe PID: 4196, type: MEMORYSTR

Remote Access Functionality

Yara detected Generic Python Stealer

Source: Yara match

File source: Process Memory Space: 7EznMik8Fw.exe PID: 4196, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Windows Service	1 Access Token Manipulation	1 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Service Execution	1 Bootkit	1 Windows Service	1 Access Token Manipulation	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Service Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Bootkit	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	26 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7EznMik8Fw.exe	29%	ReversingLabs	Win32.Ransomware.Generic
7EznMik8Fw.exe	100%	Avira	TR/PSW.Agent.tqqnk

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_x25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_cffi_backend.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://repository.swisssign.com/N	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyP	0%	Avira URL Cloud	safe
http://repository.swisssign.com/per	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
httpbin.org	34.224.200.202	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf	7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues/8996	7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp	false		high
https://api.telegram.org/bot	7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/giampaolo/psutil/issues/875.	7EznMik8Fw.exe, 00000002.00000002.3400510290.00000276FBB74000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB03A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/botz	7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://aka.ms/vcpython27	7EznMik8Fw.exe, 00000002.00000002.3398809969.00000276FA960000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/mhammond/pywin32	7EznMik8Fw.exe, 00000000.00000002.3396823044.00000231371F4000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3405282264.00007FFD9DB71000.00000002.00000001.01000000.0000001E.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3405492476.00007FFD9DEDE000.00000002.00000001.01000000.0000001D.sdmp, win32api.pyd.0.dr, pywintypes312.dll.0.dr	false		high
http://crl.dhimyotis.com/certignarootca.crl0	7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/library/unittest.html	7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2168303500.00000276FA330000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/	7EznMik8Fw.exe, 00000002.00000002.3398721697.00000276FA850000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	7EznMik8Fw.exe, 00000002.00000003.2160128430.00000276F99C1000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F9990000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/actions?query=workflow%3ACI	METADATA.0.dr	false		high
http://goo.gl/zeJZl.	7EznMik8Fw.exe, 00000002.00000002.3400184149.00000276FB8F0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	LICENSE.APACHE.0.dr	false		high
https://packaging.python.org/en/latest/specifications/core-metadata/	7EznMik8Fw.exe, 00000002.00000002.3398809969.00000276FA960000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	7EznMik8Fw.exe, 00000002.00000002.3399995307.00000276FB6C0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.kill	7EznMik8Fw.exe, 00000002.00000002.3398945430.00000276FABC0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/N	7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA56F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc3610	7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/platformdirs/platformdirs	7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0205/	7EznMik8Fw.exe, 00000002.00000002.3397753587.00000276FA020000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.accv.es	7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	7EznMik8Fw.exe, 00000002.00000002.3398945430.00000276FABC0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	7EznMik8Fw.exe, 00000002.00000002.3397104151.00000276F98FC000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/get	7EznMik8Fw.exe, 00000002.00000002.3400184149.00000276FB8C0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA56F000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFB0000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA2B1000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA2A2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/entry-points/	7EznMik8Fw.exe, 00000002.00000002.3398721697.00000276FA850000.00000004.00001000.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access	7EznMik8Fw.exe, 00000002.00000002.3397548789.00000276F9F32000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pypi.org/project/build/).	7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	7EznMik8Fw.exe, 00000002.00000003.2160128430.00000276F99C1000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F9990000.00000004.00000020.00020000.00000000.sdmp	false		high
http://foo/bar.tgz	7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	7EznMik8Fw.exe, 00000002.00000003.2162778218.00000276F9F8C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2162306851.00000276F9F54000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397548789.00000276F9F32000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crlt	7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.python.org/pipermail/python-dev/2012-June/120787.html.	7EznMik8Fw.exe, 00000002.00000002.3400306980.00000276FBA8C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/	7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F9990000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	LICENSE.APACHE.0.dr	false		high
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	METADATA.0.dr	false		high
https://wwww.certigna.fr/autorites/	7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	7EznMik8Fw.exe, 00000002.00000002.3401529100.00007FFD93003000.00000002.00000001.01000000.00000020.sdmp	false		high
https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz	7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	false		high
https://busquedasxurl.com/login/conexion/bloqueadoreslogs.php?ip=	7EznMik8Fw.exe, 00000002.00000002.3399038264.00000276FACC0000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.	7EznMik8Fw.exe, 00000002.00000002.3398721697.00000276FA850000.00000004.00001000.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397548789.00000276F9E00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/installation/	METADATA.0.dr	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	7EznMik8Fw.exe, 00000002.00000003.2160128430.00000276F99C1000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F9990000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/	7EznMik8Fw.exe, 00000002.00000002.3404019248.00007FFD9442C000.00000008.00000001.01000000.00000005.sdmp	false		high
https://docs.python.org/3/library/multiprocessing.html	7EznMik8Fw.exe, 00000002.00000002.3397548789.00000276F9F32000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	7EznMik8Fw.exe, 00000002.00000002.3397454008.00000276F9D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyP	7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wwwsearch.sf.net/):	7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA5AF000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA5AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm	7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/security/	METADATA.0.dr	false		high
https://cffi.readthedocs.io/en/latest/using.html#callbacks	7EznMik8Fw.exe, 00000002.00000002.3405122309.00007FFD9DA3D000.00000002.00000001.01000000.00000021.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl0	7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB04A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue44497.	7EznMik8Fw.exe, 00000002.00000002.3397836333.00000276FA120000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3398543024.00000276FA620000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crlyA	7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	7EznMik8Fw.exe, 00000002.00000002.3397836333.00000276FA120000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3398543024.00000276FA620000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/jaraco/jaraco.functools/issues/5	7EznMik8Fw.exe, 00000002.00000002.3398629405.00000276FA730000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399132005.00000276FADC0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es00	7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FB13C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/)	7EznMik8Fw.exe, 00000002.00000002.3403635102.00007FFD942B4000.00000002.00000001.01000000.00000005.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	7EznMik8Fw.exe, 00000002.00000002.3397240579.00000276F9990000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.rfc-editor.org/info/rfc7253	7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues	METADATA.0.dr	false		high
http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf	7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	false		high
https://readthedocs.org/projects/cryptography/badge/?version=latest	METADATA.0.dr	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA5F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/per	7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mahler:8092/site-updates.py	7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFBB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl	7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.../back.jpeg	7EznMik8Fw.exe, 00000002.00000002.3400092589.00000276FB7C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc5869	7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172635006.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography	METADATA.0.dr	false		high
https://www.python.org/download/releases/2.3/mro/.	7EznMik8Fw.exe, 00000002.00000002.3397104151.00000276F9880000.00000004.00001000.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2160714646.00000276F9A14000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
http://blog.cryptographyusering.com/2012/05/how-to-choose-authenticated-encryption.html	7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3398450388.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4A8000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFBB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA220000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172635006.00000276FA60D000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/	METADATA.0.dr	false		high
https://httpbin.org/post	7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/	METADATA.0.dr	false		high
https://github.com/Ousret/charset_normalizer	7EznMik8Fw.exe, 00000002.00000003.2172773300.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.firmaprofesional.com/cps0	7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA415000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA330000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/may	7EznMik8Fw.exe, 00000002.00000002.3399224716.00000276FAEFB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	7EznMik8Fw.exe, 00000002.00000002.3399995307.00000276FB6C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFBB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	7EznMik8Fw.exe, 00000002.00000003.2172357597.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA42C000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000003.2172017054.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp, 7EznMik8Fw.exe, 00000002.00000002.3397928807.00000276FA4DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	7EznMik8Fw.exe, 00000002.00000002.3399385291.00000276FAFBB000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.224.200.202	httpbin.org	United States		14618	AMAZON-AESUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571343
Start date and time:	2024-12-09 10:07:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7EznMik8Fw.exe renamed because original name is a hash value
Original Sample Name:	fc5586ca851cbf4eed21ae5c11b8e5d7c23379561016f779f5fe346439e2f55d.exe
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@3/122@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 48 Number of non-executed functions: 316
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
VT rate limit hit for: 7EznMik8Fw.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.224.200.202	JxrkpYVdCp.exe	Get hash	malicious	Python Stealer, Babadeda	Browse
	u08NgsGNym.exe	Get hash	malicious	Python Stealer	Browse
	L5OMdZqWzq.exe	Get hash	malicious	Python Stealer	Browse
	ssPp3zvWwN.exe	Get hash	malicious	Python Stealer	Browse
	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse
	11lbKZLNnQ.exe	Get hash	malicious	Python Stealer	Browse
	r2PcRF79Mo.exe	Get hash	malicious	Python Stealer	Browse
	eEiHdLSfum.exe	Get hash	malicious	Unknown	Browse
	eEiHdLSfum.exe	Get hash	malicious	Unknown	Browse
	nsh99t9Dox.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
httpbin.org	JxrkpYVdCp.exe	Get hash	malicious	Python Stealer, Babadeda	Browse	34.224.200.202
	u08NgsGNym.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	MkWMm5piE5.exe	Get hash	malicious	Python Stealer	Browse	44.196.3.45
	L5OMdZqWzq.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	ssPp3zvWwN.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	I6H1RkEHlX.exe	Get hash	malicious	Python Stealer	Browse	44.196.3.45
	hKgrI6tqYx.exe	Get hash	malicious	Python Stealer, Babadeda	Browse	44.196.3.45
	L5cZ63IH4a.exe	Get hash	malicious	Python Stealer	Browse	44.196.3.45
	478y7Ve1JG.exe	Get hash	malicious	Python Stealer	Browse	44.196.3.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	JxrkpYVdCp.exe	Get hash	malicious	Python Stealer, Babadeda	Browse	34.224.200.202
	u08NgsGNym.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	MkWMm5piE5.exe	Get hash	malicious	Python Stealer	Browse	44.196.3.45
	L5OMdZqWzq.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	ssPp3zvWwN.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	I6H1RkEHlX.exe	Get hash	malicious	Python Stealer	Browse	44.196.3.45
	hKgrI6tqYx.exe	Get hash	malicious	Python Stealer, Babadeda	Browse	44.196.3.45
	L5cZ63IH4a.exe	Get hash	malicious	Python Stealer	Browse	44.196.3.45
	478y7Ve1JG.exe	Get hash	malicious	Python Stealer	Browse	44.196.3.45

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_ARC4.pyd	JxrkpYVdCp.exe	Get hash	malicious	Python Stealer, Babadeda	Browse
	hSyJxPUUDx.exe	Get hash	malicious	Unknown	Browse
	u08NgsGNym.exe	Get hash	malicious	Python Stealer	Browse
	MkWMm5piE5.exe	Get hash	malicious	Python Stealer	Browse
	L5OMdZqWzq.exe	Get hash	malicious	Python Stealer	Browse
	ssPp3zvWwN.exe	Get hash	malicious	Python Stealer	Browse
	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse
	I6H1RkEHlX.exe	Get hash	malicious	Python Stealer	Browse
	hKgrI6tqYx.exe	Get hash	malicious	Python Stealer, Babadeda	Browse
	33sKdwH6im.exe	Get hash	malicious	Python Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.703513333396807
Encrypted:	false
SSDEEP:	96:nDzb9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDV90OcX6gY/7ECFV:Dzz9damqTrpYTst0E5DVPcqgY/79X
MD5:	6176101B7C377A32C01AE3EDB7FD4DE6
SHA1:	5F1CB443F9D677F313BEC07C5241AEAB57502F5E
SHA-256:	EFEA361311923189ECBE3240111EFBA329752D30457E0DBE9628A82905CD4BDB
SHA-512:	3E7373B71AE0834E96A99595CFEF2E96C0F5230429ADC0B5512F4089D1ED0D7F7F0E32A40584DFB13C41D257712A9C4E9722366F0A21B907798AE79D8CEDCF30
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: JxrkpYVdCp.exe, Detection: malicious, Browse Filename: hSyJxPUUDx.exe, Detection: malicious, Browse Filename: u08NgsGNym.exe, Detection: malicious, Browse Filename: MkWMm5piE5.exe, Detection: malicious, Browse Filename: L5OMdZqWzq.exe, Detection: malicious, Browse Filename: ssPp3zvWwN.exe, Detection: malicious, Browse Filename: okG6LaM2yP.exe, Detection: malicious, Browse Filename: I6H1RkEHlX.exe, Detection: malicious, Browse Filename: hKgrI6tqYx.exe, Detection: malicious, Browse Filename: 33sKdwH6im.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.968452734961967
Encrypted:	false
SSDEEP:	96:JF3TgNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDqbwYH/kcX6gT:WF/1nb2mhQtkXHTeZ87VDqrMcqgYvEp
MD5:	371776A7E26BAEB3F75C93A8364C9AE0
SHA1:	BF60B2177171BA1C6B4351E6178529D4B082BDA9
SHA-256:	15257E96D1CA8480B8CB98F4C79B6E365FE38A1BA9638FC8C9AB7FFEA79C4762
SHA-512:	C23548FBCD1713C4D8348917FF2AB623C404FB0E9566AB93D147C62E06F51E63BDAA347F2D203FE4F046CE49943B38E3E9FA1433F6455C97379F2BC641AE7CE9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.061461040216793
Encrypted:	false
SSDEEP:	192:ldF/1nb2mhQtkXn0t/WS60YYDEiqvdvGyv9lkVcqgYvEMo:v2f6XSZ6XYD6vdvGyv9MgYvEMo
MD5:	CB5238E2D4149636377F9A1E2AF6DC57
SHA1:	038253BABC9E652BA4A20116886209E2BCCF35AC
SHA-256:	A8D3BB9CD6A78EBDB4F18693E68B659080D08CB537F9630D279EC9F26772EFC7
SHA-512:	B1E6AB509CF1E5ECC6A60455D6900A76514F8DF43F3ABC3B8D36AF59A3DF8A868B489ED0B145D0D799AAC8672CBF5827C503F383D3F38069ABF6056ECCD87B21
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.236167046748013
Encrypted:	false
SSDEEP:	192:/siHXqpoUol3xZhRyQX5lDnRDFYav+tcqgRvE:h6D+XBDgDgRvE
MD5:	D9E7218460AEE693BEA07DA7C2B40177
SHA1:	9264D749748D8C98D35B27BEFE6247DA23FF103D
SHA-256:	38E423D3BCC32EE6730941B19B7D5D8872C0D30D3DD8F9AAE1442CB052C599AD
SHA-512:	DDB579E2DEA9D266254C0D9E23038274D9AE33F0756419FD53EC6DC1A27D1540828EE8F4AD421A5CFFD9B805F1A68F26E70BDC1BAB69834E8ACD6D7BB7BDB0DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........R......U.....R............U......U......U................}.........Rich...........................PE..d....e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..\|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.558176937399355
Encrypted:	false
SSDEEP:	384:Dz2P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuCLg46:DzeqWB7YJlmLJ3oD/S4j990th9VCsC
MD5:	F751792DF10CDEED391D361E82DAF596
SHA1:	3440738AF3C88A4255506B55A673398838B4CEAC
SHA-256:	9524D1DADCD2F2B0190C1B8EDE8E5199706F3D6C19D3FB005809ED4FEBF3E8B5
SHA-512:	6159F245418AB7AD897B02F1AADF1079608E533B9C75006EFAF24717917EAA159846EE5DFC0E85C6CFF8810319EFECBA80C1D51D1F115F00EC1AFF253E312C00
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.285191078037458
Encrypted:	false
SSDEEP:	192:wJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4jqccqgwYUMvEW:ikRwi3wO26Ef+yuIm9PfD7wgwYUMvE
MD5:	BBEA5FFAE18BF0B5679D5C5BCD762D5A
SHA1:	D7C2721795113370377A1C60E5CEF393473F0CC5
SHA-256:	1F4288A098DA3AAC2ADD54E83C8C9F2041EC895263F20576417A92E1E5B421C1
SHA-512:	0932EC5E69696D6DD559C30C19FC5A481BEFA38539013B9541D84499F2B6834A2FFE64A1008A1724E456FF15DDA6268B7B0AD8BA14918E2333567277B3716CC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d....e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.505471888568532
Encrypted:	false
SSDEEP:	192:vd9VkyQ5f8vjVaCHpKpTTjaNe7oca2DW3Q2dhmdcqgwNeecBih:JkP5cjIGpKlqD2D4kzgwNeE
MD5:	D2175300E065347D13211F5BF7581602
SHA1:	3AE92C0B0ECDA1F6B240096A4E68D16D3DB1FFB0
SHA-256:	94556934E3F9EE73C77552D2F3FC369C02D62A4C9E7143E472F8E3EE8C00AEE1
SHA-512:	6156D744800206A431DEE418A1C561FFB45D726DC75467A91D26EE98503B280C6595CDEA02BDA6A023235BD010835EA1FC9CB843E9FEC3501980B47B6B490AF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.06124024160806
Encrypted:	false
SSDEEP:	384:bUv5cJMOZA0nmwBD+XpJgLa0Mp8Qpg4P2llyM:0K1XBD+DgLa1yTi
MD5:	45616B10ABE82D5BB18B9C3AB446E113
SHA1:	91B2C0B0F690AE3ABFD9B0B92A9EA6167049B818
SHA-256:	F348DB1843B8F38A23AEE09DD52FB50D3771361C0D529C9C9E142A251CC1D1EC
SHA-512:	ACEA8C1A3A1FA19034FD913C8BE93D5E273B7719D76CB71C36F510042918EA1D9B44AC84D849570F9508D635B4829D3E10C36A461EC63825BA178F5AC1DE85FB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.475467273446457
Encrypted:	false
SSDEEP:	384:oc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy4IYgLWi:B6H1TZXX5XmrXA+NNxWiFdLWi
MD5:	CF3C2F35C37AA066FA06113839C8A857
SHA1:	39F3B0AEFB771D871A93681B780DA3BD85A6EDD0
SHA-256:	1261783F8881642C3466B96FA5879A492EA9E0DAB41284ED9E4A82E8BCF00C80
SHA-512:	1C36B80AAE49FD5E826E95D83297AE153FDB2BC652A47D853DF31449E99D5C29F42ED82671E2996AF60DCFB862EC5536BB0A68635D4E33D33F8901711C0C8BE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.838534302892255
Encrypted:	false
SSDEEP:	192:0F/1nb2mhQtkr+juOxKbDbnHcqgYvEkrK:u2f6iuOsbDtgYvEmK
MD5:	20708935FDD89B3EDDEEA27D4D0EA52A
SHA1:	85A9FE2C7C5D97FD02B47327E431D88A1DC865F7
SHA-256:	11DD1B49F70DB23617E84E08E709D4A9C86759D911A24EBDDFB91C414CC7F375
SHA-512:	F28C31B425DC38B5E9AD87B95E8071997E4A6F444608E57867016178CD0CA3E9F73A4B7F2A0A704E45F75B7DCFF54490510C6BF8461F3261F676E9294506D09B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.9047185025862925
Encrypted:	false
SSDEEP:	192:NRgPX8lvI+KnwSDTPUDEhKWPXcqgzQkvEd:2og9rUD9mpgzQkvE
MD5:	43BBE5D04460BD5847000804234321A6
SHA1:	3CAE8C4982BBD73AF26EB8C6413671425828DBB7
SHA-256:	FAA41385D0DB8D4EE2EE74EE540BC879CF2E884BEE87655FF3C89C8C517EED45
SHA-512:	DBC60F1D11D63BEBBAB3C742FB827EFBDE6DFF3C563AE1703892D5643D5906751DB3815B97CBFB7DA5FCD306017E4A1CDCC0CDD0E61ADF20E0816F9C88FE2C9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d....e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.300163691206422
Encrypted:	false
SSDEEP:	192:j0J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrdkrRcqgUF6+6vEX:jM01si8XSi3SACqe7tDeDgUUjvE
MD5:	C6B20332B4814799E643BADFFD8DF2CD
SHA1:	E7DA1C1F09F6EC9A84AF0AB0616AFEA55A58E984
SHA-256:	61C7A532E108F67874EF2E17244358DF19158F6142680F5B21032BA4889AC5D8
SHA-512:	D50C7F67D2DFB268AD4CF18E16159604B6E8A50EA4F0C9137E26619FD7835FAAD323B5F6A2B8E3EC1C023E0678BCBE5D0F867CD711C5CD405BD207212228B2B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..B..B..B..R...B..UC..B.RC..B..C..B..UG..B..UF..B..UA..B..J..B..B..B....B..@..B.Rich.B.........................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.260220483695234
Encrypted:	false
SSDEEP:	384:9XUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZNZY0JAIg+v:99HGHfJidSK
MD5:	0B538205388FDD99A043EE3AFAA074E4
SHA1:	E0DD9306F1DBE78F7F45A94834783E7E886EB70F
SHA-256:	C4769D3E6EB2A2FECB5DEC602D45D3E785C63BB96297268E3ED069CC4A019B1A
SHA-512:	2F4109E42DB7BC72EB50BCCC21EB200095312EA00763A255A38A4E35A77C04607E1DB7BB69A11E1D80532767B20BAA4860C05F52F32BF1C81FE61A7ECCEB35ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	4.276870967324261
Encrypted:	false
SSDEEP:	384:9jUqho9weF5/eHkRnYcZiGKdZHDL7idErZjZYXGg:9RCneH//id42
MD5:	6C3E976AB9F47825A5BD9F73E8DBA74E
SHA1:	4C6EB447FE8F195CF7F4B594CE7EAF928F52B23A
SHA-256:	238CDB6B8FB611DB4626E6D202E125E2C174C8F73AE8A3273B45A0FC18DEA70C
SHA-512:	B19516F00CC0484D9CDA82A482BBFE41635CDBBE19C13F1E63F033C9A68DD36798C44F04D6BD8BAE6523A845E852D81ACADD0D5DD86AF62CC9D081B803F8DF7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.578113904149635
Encrypted:	false
SSDEEP:	96:R0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwo2Pj15XkcX6gbW6z:DVddiT7pgTctEEI4qXDo11kcqgbW6
MD5:	FEE13D4FB947835DBB62ACA7EAFF44EF
SHA1:	7CC088AB68F90C563D1FE22D5E3C3F9E414EFC04
SHA-256:	3E0D07BBF93E0748B42B1C2550F48F0D81597486038C22548224584AE178A543
SHA-512:	DEA92F935BC710DF6866E89CC6EB5B53FC7ADF0F14F3D381B89D7869590A1B0B1F98F347664F7A19C6078E7AA3EB0F773FFCB711CC4275D0ECD54030D6CF5CB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.143719741413071
Encrypted:	false
SSDEEP:	384:IUv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Q90gYP2lXCM:BKR8I+K0lDFQgLa17zU
MD5:	76F88D89643B0E622263AF676A65A8B4
SHA1:	93A365060E98890E06D5C2D61EFBAD12F5D02E06
SHA-256:	605C86145B3018A5E751C6D61FD0F85CF4A9EBF2AD1F3009A4E68CF9F1A63E49
SHA-512:	979B97AAC01633C46C048010FA886EBB09CFDB5520E415F698616987AE850FD342A4210A8DC0FAC1E059599F253565862892171403F5E4F83754D02D2EF3F366
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.353267174592179
Encrypted:	false
SSDEEP:	384:7PHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8bg6Vf4A:hPcnB8KSsB34cb+bcOYpMCBDX
MD5:	D48BFFA1AF800F6969CFB356D3F75AA6
SHA1:	2A0D8968D74EBC879A17045EFE86C7FB5C54AEE6
SHA-256:	4AA5E9CE7A76B301766D3ECBB06D2E42C2F09D0743605A91BF83069FEFE3A4DE
SHA-512:	30D14AD8C68B043CC49EAFB460B69E83A15900CB68B4E0CBB379FF5BA260194965EF300EB715308E7211A743FF07FA7F8779E174368DCAA7F704E43068CC4858
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.741247880746506
Encrypted:	false
SSDEEP:	192:0F/1nb2mhQtkgU7L9D037tfcqgYvEJPb:u2f6L9DSJxgYvEJj
MD5:	4D9182783EF19411EBD9F1F864A2EF2F
SHA1:	DDC9F878B88E7B51B5F68A3F99A0857E362B0361
SHA-256:	C9F4C5FFCDD4F8814F8C07CE532A164AB699AE8CDE737DF02D6ECD7B5DD52DBD
SHA-512:	8F983984F0594C2CAC447E9D75B86D6EC08ED1C789958AFA835B0D1239FD4D7EBE16408D080E7FCE17C379954609A93FC730B11BE6F4A024E7D13D042B27F185
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.212941287344097
Encrypted:	false
SSDEEP:	192:2F/1nb2mhQtkRySMfJ2ycxFzShJD9bAal2QDeJKcqgQx2QY:M2fKRQB2j8JD2fJagQx2QY
MD5:	F4EDB3207E27D5F1ACBBB45AAFCB6D02
SHA1:	8EAB478CA441B8AD7130881B16E5FAD0B119D3F0
SHA-256:	3274F49BE39A996C5E5D27376F46A1039B6333665BB88AF1CA6D37550FA27B29
SHA-512:	7BDEBF9829CB26C010FCE1C69E7580191084BCDA3E2847581D0238AF1CAA87E68D44B052424FDC447434D971BB481047F8F2DA1B1DEF6B18684E79E63C6FBDC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`..........................................9......\|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.181291194389683
Encrypted:	false
SSDEEP:	192:hF/1nb2mhQt7fSOp/CJPvADQHKtxSOvbcqgEvcM+:N2fNKOZWPIDnxVlgEvL
MD5:	9D28433EA8FFBFE0C2870FEDA025F519
SHA1:	4CC5CF74114D67934D346BB39CA76F01F7ACC3E2
SHA-256:	FC296145AE46A11C472F99C5BE317E77C840C2430FBB955CE3F913408A046284
SHA-512:	66B4D00100D4143EA72A3F603FB193AFA6FD4EFB5A74D0D17A206B5EF825E4CC5AF175F5FB5C40C022BDE676BA7A83087CB95C9F57E701CA4E7F0A2FCE76E599
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.140195114409974
Encrypted:	false
SSDEEP:	192:RsiHXqpo0cUp8XnUp8XjEQnlDtJI6rcqgcx2:f6DcUp8XUp8AclDA69gcx2
MD5:	8A92EE2B0D15FFDCBEB7F275154E9286
SHA1:	FA9214C8BBF76A00777DFE177398B5F52C3D972D
SHA-256:	8326AE6AD197B5586222AFA581DF5FE0220A86A875A5E116CB3828E785FBF5C2
SHA-512:	7BA71C37AAF6CB10FC5C595D957EB2846032543626DE740B50D7CB954FF910DCF7CEAA56EB161BAB9CC1F663BADA6CA71973E6570BAC7D6DA4D4CC9ED7C6C3DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.203867759982304
Encrypted:	false
SSDEEP:	192:WsiHXqpwUiv6wPf+4WVrd1DFrCqwWwcqgfvE:s6biio2Pd1DFmlgfvE
MD5:	FE16E1D12CF400448E1BE3FCF2D7BB46
SHA1:	81D9F7A2C6540F17E11EFE3920481919965461BA
SHA-256:	ADE1735800D9E82B787482CCDB0FBFBA949E1751C2005DCAE43B0C9046FE096F
SHA-512:	A0463FF822796A6C6FF3ACEBC4C5F7BA28E7A81E06A3C3E46A0882F536D656D3F8BAF6FB748008E27F255FE0F61E85257626010543FC8A45A1E380206E48F07C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.478301937972917
Encrypted:	false
SSDEEP:	192:hZ9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZkRsP0rcqgjPrvE:8Q0gH7zSccA5J6ECTGmDua89gjPrvE
MD5:	34EBB5D4A90B5A39C5E1D87F61AE96CB
SHA1:	25EE80CC1E647209F658AEBA5841F11F86F23C4E
SHA-256:	4FC70CB9280E414855DA2C7E0573096404031987C24CF60822854EAA3757C593
SHA-512:	82E27044FD53A7309ABAECA06C077A43EB075ADF1EF0898609F3D9F42396E0A1FA4FFD5A64D944705BBC1B1EBB8C2055D8A420807693CC5B70E88AB292DF81B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.69608744353984
Encrypted:	false
SSDEEP:	384:nkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+DSngkov:onx7RI26LuuHKz8+DbN
MD5:	42C2F4F520BA48779BD9D4B33CD586B9
SHA1:	9A1D6FFA30DCA5CE6D70EAC5014739E21A99F6D8
SHA-256:	2C6867E88C5D3A83D62692D24F29624063FCE57F600483BAD6A84684FF22F035
SHA-512:	1F0C18E1829A5BAE4A40C92BA7F8422D5FE8DBE582F7193ACEC4556B4E0593C898956065F398ACB34014542FCB3365DC6D4DA9CE15CB7C292C8A2F55FB48BB2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.7981108922569735
Encrypted:	false
SSDEEP:	384:qPHNP3MjevhSY/8EBbVxcJ0ihTLdFDuPHgj+kf4D:sPcKvr/jUJ0sbDGAj+t
MD5:	AB0BCB36419EA87D827E770A080364F6
SHA1:	6D398F48338FB017AACD00AE188606EB9E99E830
SHA-256:	A927548ABEA335E6BCB4A9EE0A949749C9E4AA8F8AAD481CF63E3AC99B25A725
SHA-512:	3580FB949ACEE709836C36688457908C43860E68A36D3410F3FA9E17C6A66C1CDD7C081102468E4E92E5F42A0A802470E8F4D376DAA4ED7126818538E0BD0BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.865452719694432
Encrypted:	false
SSDEEP:	384:y1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOcwgjxo:QjwyJUYToZwOLuzDNB1j
MD5:	C8FE3FF9C116DB211361FBB3EA092D33
SHA1:	180253462DD59C5132FBCCC8428DEA1980720D26
SHA-256:	25771E53CFECB5462C0D4F05F7CAE6A513A6843DB2D798D6937E39BA4B260765
SHA-512:	16826BF93C8FA33E0B5A2B088FB8852A2460E0A02D699922A39D8EB2A086E981B5ACA2B085F7A7DA21906017C81F4D196B425978A10F44402C5DB44B2BF4D00A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.867732744112887
Encrypted:	false
SSDEEP:	384:51jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNIegjxo:rjwyJOYToZwOLuzDNI7j
MD5:	A442EA85E6F9627501D947BE3C48A9DD
SHA1:	D2DEC6E1BE3B221E8D4910546AD84FE7C88A524D
SHA-256:	3DBCB4D0070BE355E0406E6B6C3E4CE58647F06E8650E1AB056E1D538B52B3D3
SHA-512:	850A00C7069FFDBA1EFE1324405DA747D7BD3BA5D4E724D08A2450B5A5F15A69A0D3EAF67CEF943F624D52A4E2159A9F7BDAEAFDC6C689EACEA9987414250F3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.860044313282322
Encrypted:	false
SSDEEP:	384:xFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDXfgjVx2:jDLh98jjRe+1WT1aAeIfMzxH2mDDIj
MD5:	59BA0E05BE85F48688316EE4936421EA
SHA1:	1198893F5916E42143C0B0F85872338E4BE2DA06
SHA-256:	C181F30332F87FEECBF930538E5BDBCA09089A2833E8A088C3B9F3304B864968
SHA-512:	D772042D35248D25DB70324476021FB4303EF8A0F61C66E7DED490735A1CC367C2A05D7A4B11A2A68D7C34427971F96FF7658D880E946C31C17008B769E3B12F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.917025846093607
Encrypted:	false
SSDEEP:	384:tFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXwElrgjhig:PYLB9Mgj0e+1WT1aAeIfMzx320DXD+j
MD5:	8194D160FB215498A59F850DC5C9964C
SHA1:	D255E8CCBCE663EE5CFD3E1C35548D93BFBBFCC0
SHA-256:	55DEFCD528207D4006D54B656FD4798977BD1AAE6103D4D082A11E0EB6900B08
SHA-512:	969EEAA754519A58C352C24841852CF0E66C8A1ADBA9A50F6F659DC48C3000627503DDFB7522DA2DA48C301E439892DE9188BF94EEAF1AE211742E48204C5E42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.999870226643325
Encrypted:	false
SSDEEP:	192:DzFRF/1nb2mhQtk4axusjfkgZhoYDQgRjcqgQvEty:DzFd2f64axnTTz5D1gQvEty
MD5:	C89BECC2BECD40934FE78FCC0D74D941
SHA1:	D04680DF546E2D8A86F60F022544DB181F409C50
SHA-256:	E5B6E58D6DA8DB36B0673539F0C65C80B071A925D2246C42C54E9FCDD8CA08E3
SHA-512:	715B3F69933841BAADC1C30D616DB34E6959FD9257D65E31C39CD08C53AFA5653B0E87B41DCC3C5E73E57387A1E7E72C0A668578BD42D5561F4105055F02993C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.025153056783597
Encrypted:	false
SSDEEP:	192:AF/1nb2mhQtks0iiNqdF4mtPjD02A5APYcqgYvEL2x:62f6fFA/4GjDFcgYvEL2x
MD5:	C4CC05D3132FDFB05089F42364FC74D2
SHA1:	DA7A1AE5D93839577BBD25952A1672C831BC4F29
SHA-256:	8F3D92DE840ABB5A46015A8FF618FF411C73009CBAA448AC268A5C619CF84721
SHA-512:	C597C70B7AF8E77BEEEBF10C32B34C37F25C741991581D67CF22E0778F262E463C0F64AA37F92FBC4415FE675673F3F92544E109E5032E488F185F1CFBC839FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.235115741550938
Encrypted:	false
SSDEEP:	192:XTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gDhgvrjcqgCieT3WQ:XafgNpj9cHW3jqXeBRamDOZgCieT
MD5:	1E201DF4B4C8A8CD9DA1514C6C21D1C4
SHA1:	3DC8A9C20313AF189A3FFA51A2EAA1599586E1B2
SHA-256:	A428372185B72C90BE61AC45224133C4AF6AE6682C590B9A3968A757C0ABD6B4
SHA-512:	19232771D4EE3011938BA2A52FA8C32E00402055038B5EDF3DDB4C8691FA7AE751A1DC16766D777A41981B7C27B14E9C1AD6EBDA7FFE1B390205D0110546EE29
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.133714807569085
Encrypted:	false
SSDEEP:	192:JZNGXEgvUh43G6coX2SSwmPL4V7wTdDlpaY2cqgWjvE:EVMhuGGF2L4STdDyYWgWjvE
MD5:	76C84B62982843367C5F5D41B550825F
SHA1:	B6DE9B9BD0E2C84398EA89365E9F6D744836E03A
SHA-256:	EBCD946F1C432F93F396498A05BF07CC77EE8A74CE9C1A283BF9E23CA8618A4C
SHA-512:	03F8BB1D0D63BF26D8A6FFF62E94B85FFB4EA1857EB216A4DEB71C806CDE107BA0F9CC7017E3779489C5CEF5F0838EDB1D70F710BCDEB629364FC288794E6AFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..\|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	5.928082706906375
Encrypted:	false
SSDEEP:	768:8bEkzS7+k9rMUb8cOe9rs9ja+V/Mhjh56GS:8bEP779rMtcOCs0I/Mhf
MD5:	B41160CF884B9E846B890E0645730834
SHA1:	A0F35613839A0F8F4A87506CD59200CCC3C09237
SHA-256:	48F296CCACE3878DE1148074510BD8D554A120CAFEF2D52C847E05EF7664FFC6
SHA-512:	F4D57351A627DD379D56C80DA035195292264F49DC94E597AA6638DF5F4CF69601F72CC64FC3C29C5CBE95D72326395C5C6F4938B7895C69A8D839654CFC8F26
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.^...0......`.....................................................`..........................................~..\|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.799063285091512
Encrypted:	false
SSDEEP:	192:nkCfXASTMeAk4OepIXcADp/X6RcqgO5vE:ZJMcPepIXcAD563gO5vE
MD5:	BA46602B59FCF8B01ABB135F1534D618
SHA1:	EFF5608E05639A17B08DCA5F9317E138BEF347B5
SHA-256:	B1BAB0E04AC60D1E7917621B03A8C72D1ED1F0251334E9FA12A8A1AC1F516529
SHA-512:	A5E2771623DA697D8EA2E3212FBDDE4E19B4A12982A689D42B351B244EFBA7EFA158E2ED1A2B5BC426A6F143E7DB810BA5542017AB09B5912B3ECC091F705C6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d....e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754688
Entropy (8bit):	7.624959985050181
Encrypted:	false
SSDEEP:	12288:I1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h9:gYmzHoxJFf1p34hcrn5Go9yQO6L
MD5:	3F20627FDED2CF90E366B48EDF031178
SHA1:	00CED7CD274EFB217975457906625B1B1DA9EBDF
SHA-256:	E36242855879D71AC57FBD42BB4AE29C6D80B056F57B18CEE0B6B1C0E8D2CF57
SHA-512:	05DE7C74592B925BB6D37528FC59452C152E0DCFC1D390EA1C48C057403A419E5BE40330B2C5D5657FEA91E05F6B96470DDDF9D84FF05B9FD4192F73D460093C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d....e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.792654050660321
Encrypted:	false
SSDEEP:	384:hBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsia15gkbQ0e1:/L/g28Ufsxg9GmvPauYLxtX1D/kf
MD5:	290D936C1E0544B6EC98F031C8C2E9A3
SHA1:	CAEEA607F2D9352DD605B6A5B13A0C0CB1EA26EC
SHA-256:	8B00C859E36CBCE3EC19F18FA35E3A29B79DE54DA6030AAAD220AD766EDCDF0A
SHA-512:	F08B67B633D3A3F57F1183950390A35BF73B384855EAAB3AE895101FBC07BCC4990886F8DE657635AD528D6C861BC2793999857472A5307FFAA963AA6685D7E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d....e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	6.060461288575063
Encrypted:	false
SSDEEP:	1536:nqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxRLpq:nqctkGACFI5t35q2JbgrwwOoqLTM9rMh
MD5:	5782081B2A6F0A3C6B200869B89C7F7D
SHA1:	0D4E113FB52FE1923FE05CDF2AB9A4A9ABEFC42E
SHA-256:	E72E06C721DD617140EDEBADD866A91CF97F7215CBB732ECBEEA42C208931F49
SHA-512:	F7FD695E093EDE26FCFD0EE45ADB49D841538EB9DAAE5B0812F29F0C942FB13762E352C2255F5DB8911F10FA1B6749755B51AAE1C43D8DF06F1D10DE5E603706
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\PublicKey\_x25519.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.488437566846231
Encrypted:	false
SSDEEP:	96:tpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADwhDTAbcX6gn/7EC:5VddiT7pgTctdErDwDTicqgn/7
MD5:	289EBF8B1A4F3A12614CFA1399250D3A
SHA1:	66C05F77D814424B9509DD828111D93BC9FA9811
SHA-256:	79AC6F73C71CA8FDA442A42A116A34C62802F0F7E17729182899327971CFEB23
SHA-512:	4B95A210C9A4539332E2FB894D7DE4E1B34894876CCD06EEC5B0FC6F6E47DE75C0E298CF2F3B5832C9E028861A53B8C8E8A172A3BE3EC29A2C9E346642412138
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d....e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.730605326965181
Encrypted:	false
SSDEEP:	96:MJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGrbMZYJWJcX6gbW6s:CVddiT7pgTctEEaEDKDlMCWJcqgbW6
MD5:	4D9C33AE53B38A9494B6FBFA3491149E
SHA1:	1A069E277B7E90A3AB0DCDEE1FE244632C9C3BE4
SHA-256:	0828CAD4D742D97888D3DFCE59E82369317847651BBA0F166023CB8ACA790B2B
SHA-512:	BDFBF29198A0C7ED69204BF9E9B6174EBB9E3BEE297DD1EB8EB9EA6D7CAF1CC5E076F7B44893E58CCF3D0958F5E3BDEE12BD090714BEB5889836EE6F12F0F49E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`..........................................'..\|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.685843290341897
Encrypted:	false
SSDEEP:	96:6ZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DHWMoG4BcX6gbW6O:IVddiT7pgTctEEO3DLoHcqgbW6
MD5:	8F4313755F65509357E281744941BD36
SHA1:	2AAF3F89E56EC6731B2A5FA40A2FE69B751EAFC0
SHA-256:	70D90DDF87A9608699BE6BBEDF89AD469632FD0ADC20A69DA07618596D443639
SHA-512:	FED2B1007E31D73F18605FB164FEE5B46034155AB5BB7FE9B255241CFA75FF0E39749200EB47A9AB1380D9F36F51AFBA45490979AB7D112F4D673A0C67899EF4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49528
Entropy (8bit):	6.662491747506177
Encrypted:	false
SSDEEP:	768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5:	F8DFA78045620CF8A732E67D1B1EB53D
SHA1:	FF9A604D8C99405BFDBBF4295825D3FCBC792704
SHA-256:	A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
SHA-512:	BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...\|!..{.&.\|!..{...\|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71448
Entropy (8bit):	6.247581706260346
Encrypted:	false
SSDEEP:	1536:rRaPPkDN3nkiP6djtX5IkTIL1yUvGJtIAOnT7SyqWx5:9anmN3nkikjV5IkTIL1yUuJtIAOnTgi
MD5:	209CBCB4E1A16AA39466A6119322343C
SHA1:	CDCCE6B64EBF11FECFF739CBC57E7A98D6620801
SHA-256:	F7069734D5174F54E89B88D717133BFF6A41B01E57F79957AB3F02DAA583F9E2
SHA-512:	5BBC4EDE01729E628260CF39DF5809624EAE795FD7D51A1ED770ED54663955674593A97B78F66DBF6AE268186273840806ED06D6F7877444D32FDCA031A9F0DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.T.S...S...S...+r..S...,...S...,...S...,...S...,...S..$....S..U+...S...S...S..$....S..$....S..$....S..$....S..Rich.S..........PE..d......e.........." ...%.f................................................... ......')....`.............................................P......d......................../..............T...........................@...@............................................text...=d.......f.................. ..`.rdata..pO.......P...j..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84760
Entropy (8bit):	6.5874715807724025
Encrypted:	false
SSDEEP:	1536:RS7z7Sj2u5in5IVfC83zYxzbdK87kW1IACVw7SyrxX:I7z+jum3MJdN7kW1IACVwX
MD5:	59D60A559C23202BEB622021AF29E8A9
SHA1:	A405F23916833F1B882F37BDBBA2DD799F93EA32
SHA-256:	706D4A0C26DD454538926CBB2FF6C64257C3D9BD48C956F7CABD6DEF36FFD13E
SHA-512:	2F60E79603CF456B2A14B8254CEC75CE8BE0A28D55A874D4FB23D92D63BBE781ED823AB0F4D13A23DC60C4DF505CBF1DBE1A0A2049B02E4BDEC8D374898002B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R...S..R.....R...W..R...V..R...Q..R...S..R..S..R..S..R..._..R...R..R......R...P..R.Rich.R.........................PE..d......e.........." ...%.....^......\|........................................P......-B....`.............................................H............0....... ..,......../...@..........T...........................p...@............................................text...k........................... ..`.rdata..p>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_cffi_backend.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	182784
Entropy (8bit):	6.193615170968096
Encrypted:	false
SSDEEP:	3072:YRAMUp3K6YoDssyudy4VcRG+nR3hnW3mjwwOdkS9S7iSSTLkK/jftw3buz:Y6MyK65ssy+MG+LnSUwjD9zSSTLL/jl8
MD5:	0572B13646141D0B1A5718E35549577C
SHA1:	EEB40363C1F456C1C612D3C7E4923210EAE4CDF7
SHA-256:	D8A76D1E31BBD62A482DEA9115FC1A109CB39AF4CF6D1323409175F3C93113A7
SHA-512:	67C28432CA8B389ACC26E47EB8C4977FDDD4AF9214819F89DF07FECBC8ED750D5F35807A1B195508DD1D77E2A7A9D7265049DCFBFE7665A7FD1BA45DA1E4E842
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I.C.I.C.I.C.1MC.I.C.<.B.I.C.&#C.I.C.<.B.I.C.<.B.I.C.<.B.I.C.1.B.I.C.4.B.I.C.I.C I.C.<.B.I.C.1KC.I.C.<.B.I.C.<!C.I.C.<.B.I.CRich.I.C................PE..d...g..e.........." .........@......`........................................@............`..........................................w..l....w....... ..........l............0.......]...............................]..8............................................text............................... ..`.rdata..............................@..@.data...h].......0...\|..............@....pdata..l...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.128664719423826
Encrypted:	false
SSDEEP:	3072:DGR936Xz4mHFK0K+bRFOoP+Szlf/EZZBKYyucV6rOoZIALPEA:qQHLK+bvvPNhf/Ei6CoX
MD5:	2A834C3738742D45C0A06D40221CC588
SHA1:	606705A593631D6767467FB38F9300D7CD04AB3E
SHA-256:	F20DFA748B878751EA1C4FE77A230D65212720652B99C4E5577BCE461BBD9089
SHA-512:	924235A506CE4D635FA7C2B34E5D8E77EFF73F963E58E29C6EF89DB157BF7BAB587678BB2120D09DA70594926D82D87DBAA5D247E861E331CF591D45EA19A117
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......x...<...<...<...5.*.:...)...>...)...0...)...4...)...8.......>...w...=...w...:.......?...<..........:.......=.....F.=.......=...Rich<...........................PE..d......e.........." ...%............p_..............................................]R....`.........................................``.......`.........................../......p.......T...............................@............................................text............................... ..`.rdata..Xl.......n..................@..@.data....4.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	252696
Entropy (8bit):	6.564448148079112
Encrypted:	false
SSDEEP:	6144:Agvd9YyMipyD41q8xDiw9qWM53pLW1AQRRRrBoZtcr3:AQ8yryD47hix4orcr3
MD5:	F930B7550574446A015BC602D59B0948
SHA1:	4EE6FF8019C6C540525BDD2790FC76385CDD6186
SHA-256:	3B9AD1D2BC9EC03D37DA86135853DAC73B3FE851B164FE52265564A81EB8C544
SHA-512:	10B864975945D6504433554F9FF11B47218CAA00F809C6BCE00F9E4089B862190A4219F659697A4BA5E5C21EDBE1D8D325950921E09371ACC4410469BD9189EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mBP\.,.\.,.\.,.Ut..R.,.Is-.^.,.Is).Q.,.Is(.T.,.Is/.X.,.f.-._.,..t-.^.,.\.-...,.f./.].,.f.!.S.,.f.,.].,.f...].,.f...].,.Rich\.,.........PE..d......e.........." ...%.t...<......................................................6.....`.........................................@T..P....T..................0'......./......P...@...T...............................@............................................text....r.......t.................. ..`.rdata...............x..............@..@.data....*...p...$...P..............@....pdata..0'.......(...t..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65816
Entropy (8bit):	6.242741772115205
Encrypted:	false
SSDEEP:	1536:MElYij3wz91lBafLEmIRhtIAOIW7SybpxC:hYZBaTEmghtIAOIWE
MD5:	B0262BD89A59A3699BFA75C4DCC3EE06
SHA1:	EB658849C646A26572DEA7F6BFC042CB62FB49DC
SHA-256:	4ADFBBD6366D9B55D902FC54D2B42E7C8C989A83016ED707BD7A302FC3FC7B67
SHA-512:	2E4B214DE3B306E3A16124AF434FF8F5AB832AA3EEB1AA0AA9B49B0ADA0928DCBB05C57909292FBE3B01126F4CD3FE0DAC9CC15EAEA5F3844D6E267865B9F7B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........u...&...&...&.}&...&..'...&..'...&..'...&..'...&...'...&.x.'...&...&}..&.x.'...&.x.'...&.x.&...&.x.'...&Rich...&........................PE..d.....e.........." ...%.T..........P@....................................................`.............................................P.............................../......X...@}..T............................\|..@............p..(............................text....S.......T.................. ..`.rdata..&O...p...P...X..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159512
Entropy (8bit):	6.846323229710623
Encrypted:	false
SSDEEP:	3072:Fik7me1FFD+znfF9mNo+Mu6tmxzE41IAZ1Ak:FikSiUNYO+J1E4b
MD5:	B71DBE0F137FFBDA6C3A89D5BCBF1017
SHA1:	A2E2BDC40FDB83CC625C5B5E8A336CA3F0C29C5F
SHA-256:	6216173194B29875E84963CD4DC4752F7CA9493F5B1FD7E4130CA0E411C8AC6A
SHA-512:	9A5C7B1E25D8E1B5738F01AEDFD468C1837F1AC8DD4A5B1D24CE86DCAE0DB1C5B20F2FF4280960BC523AEE70B71DB54FD515047CDAF10D21A8BEC3EBD6663358
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RH:..)T..)T..)T..Q...)T..VU..)T..VQ..)T..VP..)T..VW..)T.,.U..)T.]QU..)T..)U.s)T.,.Y.,)T.,.T..)T.,....)T.,.V..)T.Rich.)T.........PE..d.....e.........." ...%.d...........6....................................................`......................................... %..L...l%..x....p.......P.......@.../......4.......T...............................@............................................text....b.......d.................. ..`.rdata..............h..............@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35096
Entropy (8bit):	6.461229529356597
Encrypted:	false
SSDEEP:	768:OgYvrenSE0PXxxQ0zi+mdIAWtd5YiSyviCAMxkEj:vYTQShxQ0zlmdIAWtD7SyKAxv
MD5:	4CCBD87D76AF221F24221530F5F035D1
SHA1:	D02B989AAAC7657E8B3A70A6EE7758A0B258851B
SHA-256:	C7BBCFE2511FD1B71B916A22AD6537D60948FFA7BDE207FEFABEE84EF53CAFB5
SHA-512:	34D808ADAC96A66CA434D209F2F151A9640B359B8419DC51BA24477E485685AF10C4596A398A85269E8F03F0FC533645907D7D854733750A35BF6C691DE37799
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........*..y..y..y..y..y...x..y...x..y...x..y...x..y.J.x..y..y..y...x..y.J.x..y.J.x..y.Jky..y.J.x..yRich..y................PE..d......e.........." ...%.....>......P...............................................^.....`.........................................0E..`....E..x............p.......Z.../...........4..T............................3..@............0...............................text............................... ..`.rdata..r ...0..."..."..............@..@.data........`.......D..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55576
Entropy (8bit):	6.342203411267264
Encrypted:	false
SSDEEP:	1536:wXRnts3McbN6w/xzWssXZdR1r3RIAXtI7SyNxQ:IRvcsXZdR1rRIAXtI6
MD5:	61193E813A61A545E2D366439C1EE22A
SHA1:	F404447B0D9BFF49A7431C41653633C501986D60
SHA-256:	C21B50A7BF9DBE1A0768F5030CAC378D58705A9FE1F08D953129332BEB0FBEFC
SHA-512:	747E4D5EA1BDF8C1E808579498834E1C24641D434546BFFDFCF326E0DE8D5814504623A3D3729168B0098824C2B8929AFC339674B0D923388B9DAC66F5D9D996
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.{..w(..w(..w(.s.(..w(.tv)..w(.tr)..w(.ts)..w(.tt)..w(.v)..w(..v(..w(.sv)..w(.ss)..w(.z)..w(.w)..w(..(..w(.u)..w(Rich..w(........................PE..d......e.........." ...%.L...`............................................................`.............................................X...X............................/......(....f..T............................e..@............`...............................text....J.......L.................. ..`.rdata..D8...`...:...P..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.4674944702653665
Encrypted:	false
SSDEEP:	768:0k+cae6rjp5MoNOfZIAQUM5YiSyvjAMxkEKu:5vSjgoNOfZIAQU27SyLxv
MD5:	F3ECA4F0B2C6C17ACE348E06042981A4
SHA1:	EB694DDA8FF2FE4CCAE876DC0515A8EFEC40E20E
SHA-256:	FB57EE6ADF6E7B11451B6920DDD2FB943DCD9561C9EAE64FDDA27C7ED0BC1B04
SHA-512:	604593460666045CA48F63D4B14FA250F9C4B9E5C7E228CC9202E7692C125AACB0018B89FAA562A4197692A9BC3D2382F9E085B305272EE0A39264A2A0F53B75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.\.Sa..Sa..Sa..+...Sa..,`..Sa..,d..Sa..,e..Sa..,b..Sa.$.`..Sa.U+`..Sa..S`.USa.$.l..Sa.$.a..Sa.$...Sa.$.c..Sa.Rich.Sa.........PE..d......e.........." ...%.....8.......................................................I....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..8............................text...(........................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83224
Entropy (8bit):	6.338326324626716
Encrypted:	false
SSDEEP:	1536:MUuhDLiJfz76Xl+1ly+uCt9/s+S+pzcHS58/n1IsJHfsZIALwqw7Syraxi:MU6DL4fHdy+uCt9/sT+pzuSQ1IwHfsZS
MD5:	9C6283CC17F9D86106B706EC4EA77356
SHA1:	AF4F2F52CE6122F340E5EA1F021F98B1FFD6D5B6
SHA-256:	5CC62AAC52EDF87916DEB4EBBAD9ABB58A6A3565B32E7544F672ACA305C38027
SHA-512:	11FD6F570DD78F8FF00BE645E47472A96DAFFA3253E8BD29183BCCDE3F0746F7E436A106E9A68C57CC05B80A112365441D06CC719D51C906703B428A32C93124
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|../8z.\|8z.\|8z.\|1.T\|>z.\|-..}:z.\|-..}5z.\|-..}0z.\|-..};z.\|...}:z.\|8z.\|.z.\|s..}1z.\|...}9z.\|...}9z.\|..8\|9z.\|...}9z.\|Rich8z.\|........PE..d......e.........." ...%.v...........-.......................................`............`.............................................P............@.......0.........../...P..........T...............................@............................................text....u.......v.................. ..`.rdata...x.......z...z..............@..@.data...H...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124696
Entropy (8bit):	6.266006891462829
Encrypted:	false
SSDEEP:	3072:9PfqZRAWgyjwzCO4w5y3DUfUK8PtIAOQMo:oAWgKw2C5iSUv1
MD5:	506B13DD3D5892B16857E3E3B8A95AFB
SHA1:	42E654B36F1C79000084599D49B862E4E23D75FF
SHA-256:	04F645A32B0C58760CC6C71D09224FE90E50409EF5C81D69C85D151DFE65AFF9
SHA-512:	A94F0E9F2212E0B89EB0B5C64598B18AF71B59E1297F0F6475FA4674AE56780B1E586B5EB952C8C9FEBAD38C28AFD784273BBF56645DB2C405AFAE6F472FB65C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................}........................:...................:......:......:......:.....Rich...................PE..d.....e.........." ...%.............................................................d....`.........................................`o..P....o..................8......../.......... ...T...............................@............................................text............................... ..`.rdata..............................@..@.data...8............\|..............@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177432
Entropy (8bit):	5.976892131161338
Encrypted:	false
SSDEEP:	3072:1CRW4ljuyKK8vZktW5No6XfJN54eNWXvM4VRJNI7IM/cbP7RHs3FJZ1IAC7+y:1mfEyKKaZo6XfJ2MSV+JZW
MD5:	DDB21BD1ACDE4264754C49842DE7EBC9
SHA1:	80252D0E35568E68DED68242D76F2A5D7E00001E
SHA-256:	72BB15CD8C14BA008A52D23CDCFC851A9A4BDE13DEEE302A5667C8AD60F94A57
SHA-512:	464520ECD1587F5CEDE6219FAAC2C903EE41D0E920BF3C9C270A544B040169DCD17A4E27F6826F480D4021077AB39A6CBBD35EBB3D71672EBB412023BC9E182A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........wfj...9...9...9.n.9...9.i.8...9.i.8...9.i.8...9.i.8...9...8...9...9U..9.n.8...9...8...9...8...9...9...9...8...9Rich...9........PE..d.....e.........." ...%............\,..............................................t.....`......................................... ...d.......................8......../......x...@...T...............................@............................................text.............................. ..`.rdata...!......."..................@..@.data...(...........................@....pdata..8............^..............@..@.rsrc................j..............@..@.reloc..x............t..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36632
Entropy (8bit):	6.357254511176439
Encrypted:	false
SSDEEP:	768:6cxnHG7MYGQd0hHdzA77yeu1IACis5YiSyvoAMxkE9:6cxnm7M6dAHdzA77yeu1IACiW7Sy+xx
MD5:	C1654EBEBFEEDA425EADE8B77CA96DE5
SHA1:	A4A150F1C810077B6E762F689C657227CC4FD257
SHA-256:	AA1443A715FBF84A84F39BD89707271FC11A77B597D7324CE86FC5CFA56A63A9
SHA-512:	21705B991E75EFD5E59B8431A3B19AE5FCC38A3E7F137A9D52ACD24E7F67D61758E48ABC1C9C0D4314FA02010A1886C15EAD5BCA8DCA1B1D4CCBFC3C589D342E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S..............l..............................z.......................................z.......z.......z.......z......Rich....................PE..d......e.........." ...%.(...:.......&..............................................!n....`..........................................T..H....T...............p..`....`.../......t...DG..T............................C..@............@.......S..@....................text....&.......(.................. ..`.rdata..D....@... ...,..............@..@.data........`.......L..............@....pdata..`....p.......P..............@..@.rsrc................T..............@..@.reloc..t............^..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.608323768366966
Encrypted:	false
SSDEEP:	192:KFOWWthWzWf9BvVVWQ4mWqyVT/gqnajKsrCS81:uZWthWeN01IlGsrCt
MD5:	07EBE4D5CEF3301CCF07430F4C3E32D8
SHA1:	3B878B2B2720915773F16DBA6D493DAB0680AC5F
SHA-256:	8F8B79150E850ACC92FD6AAB614F6E3759BEA875134A62087D5DD65581E3001F
SHA-512:	6C7E4DF62EBAE9934B698F231CF51F54743CF3303CD758573D00F872B8ECC2AF1F556B094503AAE91100189C0D0A93EAF1B7CAFEC677F384A1D7B4FDA2EEE598
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0............`A........................................p...,............ ...................!..............p............................................................................rdata..d...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	6.6074868843808785
Encrypted:	false
SSDEEP:	192:PUWthW6Wf9BvVVWQ4SWZifvXqnajJ6HNbLet:MWthW3NhXll6HZm
MD5:	557405C47613DE66B111D0E2B01F2FDB
SHA1:	DE116ED5DE1FFAA900732709E5E4EEF921EAD63C
SHA-256:	913EAAA7997A6AEE53574CFFB83F9C9C1700B1D8B46744A5E12D76A1E53376FD
SHA-512:	C2B326F555B2B7ACB7849402AC85922880105857C616EF98F7FB4BBBDC2CD7F2AF010F4A747875646FCC272AB8AA4CE290B6E09A9896CE1587E638502BD4BEFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...p.~..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..H...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.622854484071805
Encrypted:	false
SSDEEP:	192:tlWthWFWf9BvVVWQ4mWIzWLiP+CjAWqnajKsNb7:/WthWANnWLiP+CcWlGsNb7
MD5:	624401F31A706B1AE2245EB19264DC7F
SHA1:	8D9DEF3750C18DDFC044D5568E3406D5D0FB9285
SHA-256:	58A8D69DF60ECBEE776CD9A74B2A32B14BF2B0BD92D527EC5F19502A0D3EB8E9
SHA-512:	3353734B556D6EEBC57734827450CE3B34D010E0C033E95A6E60800C0FDA79A1958EBF9053F12054026525D95D24EEC541633186F00F162475CEC19F07A0D817
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...YJ..........." .........................................................0.......s....`A........................................p................ ...................!..............p............................................................................rdata..T...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.670771733256744
Encrypted:	false
SSDEEP:	192:1mxD3+HWthWiWf9BvVVWQ4WWuhD7DiqnajKswz3:19HWthWfN/GlGswz3
MD5:	2DB5666D3600A4ABCE86BE0099C6B881
SHA1:	63D5DDA4CEC0076884BC678C691BDD2A4FA1D906
SHA-256:	46079C0A1B660FC187AAFD760707F369D0B60D424D878C57685545A3FCE95819
SHA-512:	7C6E1E022DB4217A85A4012C8E4DAEE0A0F987E4FBA8A4C952424EF28E250BAC38B088C242D72B4641157B7CC882161AEFA177765A2E23AFCDC627188A084345
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....^[..........." .........................................................0......@^....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15328
Entropy (8bit):	6.561472518225768
Encrypted:	false
SSDEEP:	192:RaNYPvVX8rFTsoWthWgWf9BvVVWQ4SWfMaPOoI80Hy5qnajslBE87QyX:HPvVXqWthWlN2WlslEE87Qw
MD5:	0F7D418C05128246AFA335A1FB400CB9
SHA1:	F6313E371ED5A1DFFE35815CC5D25981184D0368
SHA-256:	5C9BC70586AD538B0DF1FCF5D6F1F3527450AE16935AA34BD7EB494B4F1B2DB9
SHA-512:	7555D9D3311C8622DF6782748C2186A3738C4807FC58DF2F75E539729FC4069DB23739F391950303F12E0D25DF9F065B4C52E13B2EBB6D417CA4C12CFDECA631
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...*.;A.........." .........................................................@.......m....`A........................................p................0...................!..............p............................................................................rdata..<...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.638884356866373
Encrypted:	false
SSDEEP:	192:jlWaWthWAWf9BvVVWQ4WWloprVP+CjAWqnajKsNWqL:jIaWthWFNxtVP+CcWlGsNxL
MD5:	5A72A803DF2B425D5AAFF21F0F064011
SHA1:	4B31963D981C07A7AB2A0D1A706067C539C55EC5
SHA-256:	629E52BA4E2DCA91B10EF7729A1722888E01284EED7DDA6030D0A1EC46C94086
SHA-512:	BF44997C405C2BA80100EB0F2FF7304938FC69E4D7AE3EAC52B3C236C3188E80C9F18BDA226B5F4FDE0112320E74C198AD985F9FFD7CEA99ACA22980C39C7F69
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...=+vj.........." .........................................................0.......N....`A........................................p...L............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11744
Entropy (8bit):	6.744400973311854
Encrypted:	false
SSDEEP:	96:imdzvQzEWthWwMVDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLN5DEs3r:v3WthWyWf9BvVVWQ4SWVVFJqqnajW2y
MD5:	721B60B85094851C06D572F0BD5D88CD
SHA1:	4D0EE4D717AEB9C35DA8621A545D3E2B9F19B4E7
SHA-256:	DAC867476CAA42FF8DF8F5DFE869FFD56A18DADEE17D47889AFB69ED6519AFBF
SHA-512:	430A91FCECDE4C8CC4AC7EB9B4C6619243AB244EE88C34C9E93CA918E54BD42B08ACA8EA4475D4C0F5FA95241E4AACB3206CBAE863E92D15528C8E7C9F45601B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......T`....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	6.638488013343178
Encrypted:	false
SSDEEP:	192:frWthWFWf9BvVVWQ4SWNOfvXqnajJ6H4WJ:frWthWANRXll6H4WJ
MD5:	D1DF480505F2D23C0B5C53DF2E0E2A1A
SHA1:	207DB9568AFD273E864B05C87282987E7E81D0BA
SHA-256:	0B3DFB8554EAD94D5DA7859A12DB353942406F9D1DFE3FAC3D48663C233EA99D
SHA-512:	F14239420F5DD84A15FF5FCA2FAD81D0AA9280C566FA581122A018E10EBDF308AC0BF1D3FCFC08634C1058C395C767130C5ABCA55540295C68DF24FFD931CA0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....(..........." .........................................................0......;.....`A........................................p...`............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12256
Entropy (8bit):	6.588267640761022
Encrypted:	false
SSDEEP:	192:txlkWthW2Wf9BvVVWQ4SWBBBuUgxfzfqnaj0OTWv:txlkWthW7NkIrloFv
MD5:	73433EBFC9A47ED16EA544DDD308EAF8
SHA1:	AC1DA1378DD79762C6619C9A63FD1EBE4D360C6F
SHA-256:	C43075B1D2386A8A262DE628C93A65350E52EAE82582B27F879708364B978E29
SHA-512:	1C28CC0D3D02D4C308A86E9D0BC2DA88333DFA8C92305EC706F3E389F7BB6D15053040AFD1C4F0AA3383F3549495343A537D09FE882DB6ED12B7507115E5A263
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....pi..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..<...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.678828474114903
Encrypted:	false
SSDEEP:	192:4TWthWckWf9BvVVWQ4mWQAyUD7DiqnajKswzjdg:4TWthWcRNqGlGswzji
MD5:	7C7B61FFA29209B13D2506418746780B
SHA1:	08F3A819B5229734D98D58291BE4BFA0BEC8F761
SHA-256:	C23FE8D5C3CA89189D11EC8DF983CC144D168CB54D9EAB5D9532767BCB2F1FA3
SHA-512:	6E5E3485D980E7E2824665CBFE4F1619B3E61CE3BCBF103979532E2B1C3D22C89F65BCFBDDBB5FE88CDDD096F8FD72D498E8EE35C3C2307BACECC6DEBBC1C97F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....\|............" .........................................................0.......3....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.602852377056617
Encrypted:	false
SSDEEP:	192:Us13vuBL3B5LoWthW7Wf9BvVVWQ4mWgB7OQP+CjAWqnajKsN9arO:Us13vuBL3B2WthWmNVXP+CcWlGsN9P
MD5:	6D0550D3A64BD3FD1D1B739133EFB133
SHA1:	C7596FDE7EA1C676F0CC679CED8BA810D15A4AFE
SHA-256:	F320F9C0463DE641B396CE7561AF995DE32211E144407828B117088CF289DF91
SHA-512:	5DA9D490EF54A1129C94CE51349399B9012FC0D4B575AE6C9F1BAFCFCF7F65266F797C539489F882D4AD924C94428B72F5137009A851ECB541FE7FB9DE12FEB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...]. ,.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..X...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14800
Entropy (8bit):	6.528059454770997
Encrypted:	false
SSDEEP:	384:On2OMw3zdp3bwjGfue9/0jCRrndbZWWthWdNHhfVlGsSH:/OMwBprwjGfue9/0jCRrndbLEKv
MD5:	1ED0B196AB58EDB58FCF84E1739C63CE
SHA1:	AC7D6C77629BDEE1DF7E380CC9559E09D51D75B7
SHA-256:	8664222823E122FCA724620FD8B72187FC5336C737D891D3CEF85F4F533B8DE2
SHA-512:	E1FA7F14F39C97AAA3104F3E13098626B5F7CFD665BA52DCB2312A329639AAF5083A9177E4686D11C4213E28ACC40E2C027988074B6CC13C5016D5C5E9EF897B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...w............" .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.659218747104705
Encrypted:	false
SSDEEP:	192:2E+tWthWvWf9BvVVWQ4mWxHD7DiqnajKswzGIAf:T+tWthWiNcGlGswzLAf
MD5:	721BAEA26A27134792C5CCC613F212B2
SHA1:	2A27DCD2436DF656A8264A949D9CE00EAB4E35E8
SHA-256:	5D9767D8CCA0FBFD5801BFF2E0C2ADDDD1BAAAA8175543625609ABCE1A9257BD
SHA-512:	9FD6058407AA95058ED2FDA9D391B7A35FA99395EC719B83C5116E91C9B448A6D853ECC731D0BDF448D1436382EECC1FA9101F73FA242D826CC13C4FD881D9BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...,OT..........." .........................................................0...........`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.739082809754283
Encrypted:	false
SSDEEP:	192:vdWthW8Wf9BvVVWQ4mWG2P+CjAWqnajKsNt:lWthWJNUP+CcWlGsNt
MD5:	B3F887142F40CB176B59E58458F8C46D
SHA1:	A05948ABA6F58EB99BBAC54FA3ED0338D40CBFAD
SHA-256:	8E015CDF2561450ED9A0773BE1159463163C19EAB2B6976155117D16C36519DA
SHA-512:	7B762319EC58E3FCB84B215AE142699B766FA9D5A26E1A727572EE6ED4F5D19C859EFB568C0268846B4AA5506422D6DD9B4854DA2C9B419BFEC754F547203F7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...X.j..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.601112204637961
Encrypted:	false
SSDEEP:	192:GFPWthW5Wf9BvVVWQ4mWc0ZD7DiqnajKswzczr:GFPWthWsNiGlGswzq
MD5:	89F35CB1212A1FD8FBE960795C92D6E8
SHA1:	061AE273A75324885DD098EE1FF4246A97E1E60C
SHA-256:	058EB7CE88C22D2FF7D3E61E6593CA4E3D6DF449F984BF251D9432665E1517D1
SHA-512:	F9E81F1FEAB1535128B16E9FF389BD3DAAAB8D1DABF64270F9E563BE9D370C023DE5D5306DD0DE6D27A5A099E7C073D17499442F058EC1D20B9D37F56BCFE6D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...ig............" .........................................................0......H.....`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14288
Entropy (8bit):	6.521808801015781
Encrypted:	false
SSDEEP:	192:/uUk1Jzb9cKcIzWthWzaWf9BvVVWQ4mWmrcLUVT/gqnajKsrCOV:/bk1JzBcKcIzWthWzXNz1IlGsrCOV
MD5:	0C933A4B3C2FCF1F805EDD849428C732
SHA1:	B8B19318DBB1D2B7D262527ABD1468D099DE3FB6
SHA-256:	A5B733E3DCE21AB62BD4010F151B3578C6F1246DA4A96D51AC60817865648DD3
SHA-512:	B25ED54345A5B14E06AA9DADD07B465C14C23225023D7225E04FBD8A439E184A7D43AB40DF80E3F8A3C0F2D5C7A79B402DDC6B9093D0D798E612F4406284E39D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....U..........." .........................................................0......Y.....`A........................................p................ ...................!..............p............................................................................rdata..4...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.671157737548847
Encrypted:	false
SSDEEP:	192:7oDfIeVWthWZWf9BvVVWQ4mWaHvP+CjAWqnajKsNZ:7oDfIeVWthWMNVP+CcWlGsNZ
MD5:	7E8B61D27A9D04E28D4DAE0BFA0902ED
SHA1:	861A7B31022915F26FB49C79AC357C65782C9F4B
SHA-256:	1EF06C600C451E66E744B2CA356B7F4B7B88BA2F52EC7795858D21525848AC8C
SHA-512:	1C5B35026937B45BEB76CB8D79334A306342C57A8E36CC15D633458582FC8F7D9AB70ACE7A92144288C6C017F33ECFC20477A04432619B40A21C9CDA8D249F6D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......N.....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.599056003106114
Encrypted:	false
SSDEEP:	192:gR7WthWTVWf9BvVVWQ4mWg2a5P+CjAWqnajKsNQbWl:gVWthWkN/P+CcWlGsNMg
MD5:	8D12FFD920314B71F2C32614CC124FEC
SHA1:	251A98F2C75C2E25FFD0580F90657A3EA7895F30
SHA-256:	E63550608DD58040304EA85367E9E0722038BA8E7DC7BF9D91C4D84F0EC65887
SHA-512:	5084C739D7DE465A9A78BCDBB8A3BD063B84A68DCFD3C9EF1BFA224C1CC06580E2A2523FD4696CFC48E9FD068A2C44DBC794DD9BDB43DC74B4E854C82ECD3EA5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....X4.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.602527553095181
Encrypted:	false
SSDEEP:	192:zGeVfcWthW+Wf9BvVVWQ4mWMiSID7DiqnajKswz5g:zGeVfcWthWjN6SIGlGswza
MD5:	9FA3FC24186D912B0694A572847D6D74
SHA1:	93184E00CBDDACAB7F2AD78447D0EAC1B764114D
SHA-256:	91508AB353B90B30FF2551020E9755D7AB0E860308F16C2F6417DFB2E9A75014
SHA-512:	95AD31C9082F57EA57F5B4C605331FCAD62735A1862AFB01EF8A67FEA4E450154C1AE0C411CF3AC5B9CD35741F8100409CC1910F69C1B2D807D252389812F594
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....P..........." .........................................................0.......`....`A........................................p................ ...................!..............p............................................................................rdata..P...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.6806369134652055
Encrypted:	false
SSDEEP:	192:qyMv0WthWPWf9BvVVWQ4mWIv/r+YVqnajKsSF:qyMv0WthWCNBfVlGsSF
MD5:	C9CBAD5632D4D42A1BC25CCFA8833601
SHA1:	09F37353A89F1BFE49F7508559DA2922B8EFEB05
SHA-256:	F3A7A9C98EBE915B1B57C16E27FFFD4DDF31A82F0F21C06FE292878E48F5883E
SHA-512:	2412E0AFFDC6DB069DE7BD9666B7BAA1CD76AA8D976C9649A4C2F1FFCE27F8269C9B02DA5FD486EC86B54231B1A5EBF6A1C72790815B7C253FEE1F211086892F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....E.=.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..,...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13776
Entropy (8bit):	6.573983778839785
Encrypted:	false
SSDEEP:	384:miwidv3V0dfpkXc0vVauzIWthWLN3fVlGsStY:nHdv3VqpkXc0vVaKbiYlY
MD5:	4CCDE2D1681217E282996E27F3D9ED2E
SHA1:	8EDA134B0294ED35E4BBAC4911DA620301A3F34D
SHA-256:	D6708D1254ED88A948871771D6D1296945E1AA3AEB7E33E16CC378F396C61045
SHA-512:	93FE6AE9A947AC88CC5ED78996E555700340E110D12B2651F11956DB7CEE66322C269717D31FCCB31744F4C572A455B156B368F08B70EDA9EFFEC6DE01DBAB23
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....k,..........." .........................................................0......3.....`A........................................p...X............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.7137872023984055
Encrypted:	false
SSDEEP:	192:TtZ3KjWthWzWf9BvVVWQ4mWXU0P+CjAWqnajKsN2v:TtZ3KjWthWeNwP+CcWlGsNa
MD5:	E86CFC5E1147C25972A5EEFED7BE989F
SHA1:	0075091C0B1F2809393C5B8B5921586BDD389B29
SHA-256:	72C639D1AFDA32A65143BCBE016FE5D8B46D17924F5F5190EB04EFE954C1199A
SHA-512:	EA58A8D5AA587B7F5BDE74B4D394921902412617100ED161A7E0BEF6B3C91C5DAE657065EA7805A152DD76992997017E070F5415EF120812B0D61A401AA8C110
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...jN/..........." .........................................................0............`A........................................p...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12768
Entropy (8bit):	6.614330511483598
Encrypted:	false
SSDEEP:	192:vgdKIMFYJWthW2Wf9BvVVWQ4SW2zZ7uUgxfzfqnaj0OGWh:0hJWthW7NBzIrloYh
MD5:	206ADCB409A1C9A026F7AFDFC2933202
SHA1:	BB67E1232A536A4D1AE63370BD1A9B5431335E77
SHA-256:	76D8E4ED946DEEFEEFA0D0012C276F0B61F3D1C84AF00533F4931546CBB2F99E
SHA-512:	727AA0C4CD1A0B7E2AFFDCED5DA3A0E898E9BAE3C731FF804406AD13864CEE2B27E5BAAC653BAB9A0D2D961489915D4FCAD18557D4383ECB0A066902276955A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....~y..........." .........................................................0............`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.704366348384627
Encrypted:	false
SSDEEP:	192:Ha2WthWKOWf9BvVVWQ4mWNOrVT/gqnajKsrCkb:Ha2WthWKTNz1IlGsrCo
MD5:	91A2AE3C4EB79CF748E15A58108409AD
SHA1:	D402B9DF99723EA26A141BFC640D78EAF0B0111B
SHA-256:	B0EDA99EABD32FEFECC478FD9FE7439A3F646A864FDAB4EC3C1F18574B5F8B34
SHA-512:	8527AF610C1E2101B6F336A142B1A85AC9C19BB3AF4AD4A245CFB6FD602DC185DA0F7803358067099475102F3A8F10A834DC75B56D3E6DED2ED833C00AD217ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....%j.........." .........................................................0......\|B....`A........................................p...P............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.623077637622405
Encrypted:	false
SSDEEP:	192:jWthWYWf9BvVVWQ4mWd8l1P+CjAWqnajKsNeCw:jWthW9NnP+CcWlGsNex
MD5:	1E4C4C8E643DE249401E954488744997
SHA1:	DB1C4C0FC907100F204B21474E8CD2DB0135BC61
SHA-256:	F28A8FE2CD7E8E00B6D2EC273C16DB6E6EEA9B6B16F7F69887154B6228AF981E
SHA-512:	EF8411FD321C0E363C2E5742312CC566E616D4B0A65EFF4FB6F1B22FDBEA3410E1D75B99E889939FF70AD4629C84CEDC88F6794896428C5F0355143443FDC3A3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....R..........." .........................................................0............`A........................................p...<............ ...................!..............p............................................................................rdata..p...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.643812426159955
Encrypted:	false
SSDEEP:	192:fSWthWvWf9BvVVWQ4mWFl5P+CjAWqnajKsNifl:aWthWiN+5P+CcWlGsNiN
MD5:	FA770BCD70208A479BDE8086D02C22DA
SHA1:	28EE5F3CE3732A55CA60AEE781212F117C6F3B26
SHA-256:	E677497C1BAEFFFB33A17D22A99B76B7FA7AE7A0C84E12FDA27D9BE5C3D104CF
SHA-512:	F8D81E350CEBDBA5AFB579A072BAD7986691E9F3D4C9FEBCA8756B807301782EE6EB5BA16B045CFA29B6E4F4696E0554C718D36D4E64431F46D1E4B1F42DC2B8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................" .........................................................0......l.....`A........................................P................ ...................!..............p............................................................................rdata..@...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15824
Entropy (8bit):	6.438848882089563
Encrypted:	false
SSDEEP:	192:yjQ/w8u4cyNWthWYWf9BvVVWQ4mWhu1BVT/gqnajKsrC74m:8yNWthW9Np1IlGsrCEm
MD5:	4EC4790281017E616AF632DA1DC624E1
SHA1:	342B15C5D3E34AB4AC0B9904B95D0D5B074447B7
SHA-256:	5CF5BBB861608131B5F560CBF34A3292C80886B7C75357ACC779E0BF98E16639
SHA-512:	80C4E20D37EFF29C7577B2D0ED67539A9C2C228EDB48AB05D72648A6ED38F5FF537715C130342BEB0E3EF16EB11179B9B484303354A026BDA3A86D5414D24E69
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....P............" .........................................................@............`A........................................P................0...................!..............p............................................................................rdata..>...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.6061629057490245
Encrypted:	false
SSDEEP:	192:vWOPWthWAWf9BvVVWQ4mWWbgftmP+CjAWqnajKsNURPblh:BWthWFN+f8P+CcWlGsNURzv
MD5:	7A859E91FDCF78A584AC93AA85371BC9
SHA1:	1FA9D9CAD7CC26808E697373C1F5F32AAF59D6B7
SHA-256:	B7EE468F5B6C650DADA7DB3AD9E115A0E97135B3DF095C3220DFD22BA277B607
SHA-512:	A368F21ECA765AFCA86E03D59CF953500770F4A5BFF8B86B2AC53F1B5174C627E061CE9A1F781DC56506774E0D0B09725E9698D4DC2D3A59E93DA7EF3D900887
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...t............." .........................................................0......H.....`A........................................P..."............ ...................!..............p............................................................................rdata..r...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13776
Entropy (8bit):	6.65347762698107
Encrypted:	false
SSDEEP:	192:WxSnWlC0i5ClWthWTWf9BvVVWQ4mW+hkKVT/gqnajKsrCw/:WxSnWm5ClWthW+NkK1IlGsrCY
MD5:	972544ADE7E32BFDEB28B39BC734CDEE
SHA1:	87816F4AFABBDEC0EC2CFEB417748398505C5AA9
SHA-256:	7102F8D9D0F3F689129D7FE071B234077FBA4DD3687071D1E2AEAA137B123F86
SHA-512:	5E1131B405E0C7A255B1C51073AFF99E2D5C0D28FD3E55CABC04D463758A575A954008EA1BA5B4E2B345B49AF448B93AD21DFC4A01573B3CB6E7256D9ECCEEF1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...1............" .........................................................0......':....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.58394079658593
Encrypted:	false
SSDEEP:	192:YFY17aFBRQWthWIWf9BvVVWQ4mWHhOP+CjAWqnajKsNngJ:YQtWthWNNdP+CcWlGsNI
MD5:	8906279245F7385B189A6B0B67DF2D7C
SHA1:	FCF03D9043A2DAAFE8E28DEE0B130513677227E4
SHA-256:	F5183B8D7462C01031992267FE85680AB9C5B279BEDC0B25AB219F7C2184766F
SHA-512:	67CAC89AE58CC715976107F3BDF279B1E78945AFD07E6F657E076D78E92EE1A98E3E7B8FEAE295AF5CE35E00C804F3F53A890895BADB1EED32377D85C21672B9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0.......l....`A........................................P................ ...................!..............p............................................................................rdata..f...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.696904963591775
Encrypted:	false
SSDEEP:	192:m8qWthWLWf9BvVVWQ4WWLXlyBZr+YVqnajKsS1:mlWthWWN0uZfVlGsS1
MD5:	DD8176E132EEDEA3322443046AC35CA2
SHA1:	D13587C7CC52B2C6FBCAA548C8ED2C771A260769
SHA-256:	2EB96422375F1A7B687115B132A4005D2E7D3D5DC091FB0EB22A6471E712848E
SHA-512:	77CB8C44C8CC8DD29997FBA4424407579AC91176482DB3CF7BC37E1F9F6AA4C4F5BA14862D2F3A9C05D1FDD7CA5A043B5F566BD0E9A9E1ED837DA9C11803B253
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...r..[.........." .........................................................0.......P....`A........................................P...e............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	6.216554714002396
Encrypted:	false
SSDEEP:	384:rQM4Oe59Ckb1hgmLRWthW0N0JBJ1IlGsrC5W:sMq59Bb1jYNABHJc
MD5:	A6A3D6D11D623E16866F38185853FACD
SHA1:	FBEADD1E9016908ECCE5753DE1D435D6FCF3D0B5
SHA-256:	A768339F0B03674735404248A039EC8591FCBA6FF61A3C6812414537BADD23B0
SHA-512:	ABBF32CEB35E5EC6C1562F9F3B2652B96B7DBD97BFC08D918F987C0EC0503E8390DD697476B2A2389F0172CD8CF16029FD2EC5F32A9BA3688BF2EBEEFB081B2C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........,...............................................P............`A........................................P....%...........@...............0...!..............p............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.604643094751227
Encrypted:	false
SSDEEP:	192:uFdyqjd7NWthWxWf9BvVVWQ4mW+JZD7DiqnajKswzR1:YQsWthWkNfZGlGswzR1
MD5:	074B81A625FB68159431BB556D28FAB5
SHA1:	20F8EAD66D548CFA861BC366BB1250CED165BE24
SHA-256:	3AF38920E767BD9EBC08F88EAF2D08C748A267C7EC60EAB41C49B3F282A4CF65
SHA-512:	36388C3EFFA0D94CF626DECAA1DA427801CC5607A2106ABDADF92252C6F6FD2CE5BF0802F5D0A4245A1FFDB4481464C99D60510CF95E83EBAF17BD3D6ACBC3DC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....u..........." .........................................................0............`A........................................P...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16336
Entropy (8bit):	6.449023660091811
Encrypted:	false
SSDEEP:	192:eUW9MPrpJhhf4AN5/KihWthWBWf9BvVVWQ4mWRXwsD7DiqnajKswzK:eUZr7HWthWUNkGlGswzK
MD5:	F1A23C251FCBB7041496352EC9BCFFBE
SHA1:	BE4A00642EC82465BC7B3D0CC07D4E8DF72094E8
SHA-256:	D899C2F061952B3B97AB9CDBCA2450290B0F005909DDD243ED0F4C511D32C198
SHA-512:	31F8C5CD3B6E153073E2E2EDF0CA8072D0F787784F1611A57219349C1D57D6798A3ADBD6942B0F16CEF781634DD8691A5EC0B506DF21B24CB70AEE5523A03FD9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....h.y.........." .........................................................@............`A........................................P...4............0...................!..............p............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17872
Entropy (8bit):	6.3934828478655685
Encrypted:	false
SSDEEP:	192:hA2uWYFxEpahDWthWDWf9BvVVWQ4mWR3ir+YVqnajKsSO:hIFVhDWthWONlfVlGsSO
MD5:	55B2EB7F17F82B2096E94BCA9D2DB901
SHA1:	44D85F1B1134EE7A609165E9C142188C0F0B17E0
SHA-256:	F9D3F380023A4C45E74170FE69B32BCA506EE1E1FBE670D965D5B50C616DA0CB
SHA-512:	0CF0770F5965A83F546253DECFA967D8F85C340B5F6EA220D3CAA14245F3CDB37C53BF8D3DA6C35297B22A3FA88E7621202634F6B3649D7D9C166A221D3456A5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......w.........." ......... ...............................................@......>>....`A........................................P...a............0...............$...!..............p............................................................................rdata..............................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18384
Entropy (8bit):	6.279474608881223
Encrypted:	false
SSDEEP:	384:jvEvevdv8vPozmVx0C5yguNvZ5VQgx3SbwA7yMVIkFGlPWthWXNjqujGlGswz7:2ozmT5yguNvZ5VQgx3SbwA71IkFFaJft
MD5:	9B79965F06FD756A5EFDE11E8D373108
SHA1:	3B9DE8BF6B912F19F7742AD34A875CBE2B5FFA50
SHA-256:	1A916C0DB285DEB02C0B9DF4D08DAD5EA95700A6A812EA067BD637A91101A9F6
SHA-512:	7D4155C00D65C3554E90575178A80D20DC7C80D543C4B5C4C3F508F0811482515638FE513E291B82F958B4D7A63C9876BE4E368557B07FF062961197ED4286FB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...$............" ........."...............................................@............`A........................................P................0...............&...!..............p............................................................................rdata../...........................@..@.rsrc........0......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14288
Entropy (8bit):	6.547753630184197
Encrypted:	false
SSDEEP:	192:ENDCWthWHWf9BvVVWQ4mWG5xqcVT/gqnajKsrC/V:TWthW6N/xqc1IlGsrC/V
MD5:	1D48A3189A55B632798F0E859628B0FB
SHA1:	61569A8E4F37ADC353986D83EFC90DC043CDC673
SHA-256:	B56BC94E8539603DD2F0FEA2F25EFD17966315067442507DB4BFFAFCBC2955B0
SHA-512:	47F329102B703BFBB1EBAEB5203D1C8404A0C912019193C93D150A95BB0C5BA8DC101AC56D3283285F9F91239FC64A66A5357AFE428A919B0BE7194BADA1F64F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...E............" .........................................................0......f.....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.686357863452704
Encrypted:	false
SSDEEP:	192:ZjfHQdufWthWCWf9BvVVWQ4mWMlUteSP+CjAWqnajKsN0c:ZfZWthW/Nd4P+CcWlGsN0c
MD5:	DBC27D384679916BA76316FB5E972EA6
SHA1:	FB9F021F2220C852F6FF4EA94E8577368F0616A4
SHA-256:	DD14133ADF5C534539298422F6C4B52739F80ACA8C5A85CA8C966DEA9964CEB1
SHA-512:	CC0D8C56749CCB9D007B6D3F5C4A8F1D4E368BB81446EBCD7CC7B40399BBD56D0ACABA588CA172ECB7472A8CBDDBD4C366FFA38094A832F6D7E343B813BA565E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....@n#.........." .........................................................0............`A........................................P...^............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\base_library.zip

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332263
Entropy (8bit):	5.5864676354018465
Encrypted:	false
SSDEEP:	12288:uttcY+bStOmgRF1+fYNXPh26UZWAzCu7joqYnhjHgkVHdmmPnHz1dG6sF7aYceM:uttcY+UHCiCAd+cqHdmmPHzvwaYceM
MD5:	630153AC2B37B16B8C5B0DBB69A3B9D6
SHA1:	F901CD701FE081489B45D18157B4A15C83943D9D
SHA-256:	EC4E6B8E9F6F1F4B525AF72D3A6827807C7A81978CB03DB5767028EBEA283BE2
SHA-512:	7E3A434C8DF80D32E66036D831CBD6661641C0898BD0838A07038B460261BF25B72A626DEF06D0FAA692CAF64412CA699B1FA7A848FE9D969756E097CBA39E41
Malicious:	false
Preview:	PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI43442\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290282
Entropy (8bit):	6.048183244201235
Encrypted:	false
SSDEEP:	6144:QW1H/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5Np:QWN/TRJLWURrI55MWavdF0L
MD5:	302B49C5F476C0AE35571430BB2E4AA0
SHA1:	35A7837A3F1B960807BF46B1C95EC22792262846
SHA-256:	CF9D37FA81407AFE11DCC0D70FE602561422AA2344708C324E4504DB8C6C5748
SHA-512:	1345AF52984B570B1FF223032575FEB36CDFB4F38E75E0BD3B998BC46E9C646F7AC5C583D23A70460219299B9C04875EF672BF5A0D614618731DF9B7A5637D0A
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI43442\charset_normalizer\md.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.674392865869017
Encrypted:	false
SSDEEP:	96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
MD5:	D9E0217A89D9B9D1D778F7E197E0C191
SHA1:	EC692661FCC0B89E0C3BDE1773A6168D285B4F0D
SHA-256:	ECF12E2C0A00C0ED4E2343EA956D78EED55E5A36BA49773633B2DFE7B04335C0
SHA-512:	3B788AC88C1F2D682C1721C61D223A529697C7E43280686B914467B3B39E7D6DEBAFF4C0E2F42E9DDDB28B522F37CB5A3011E91C66D911609C63509F9228133D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d....jAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	5.917175475547778
Encrypted:	false
SSDEEP:	3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
MD5:	BF9A9DA1CF3C98346002648C3EAE6DCF
SHA1:	DB16C09FDC1722631A7A9C465BFE173D94EB5D8B
SHA-256:	4107B1D6F11D842074A9F21323290BBE97E8EED4AA778FBC348EE09CC4FA4637
SHA-512:	7371407D12E632FC8FB031393838D36E6A1FE1E978CED36FF750D84E183CDE6DD20F75074F4597742C9F8D6F87AF12794C589D596A81B920C6C62EE2BA2E5654
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d....jAe.........." ...%.:...........<.......................................0............`.........................................@...d.......................(............ ......P...................................@............P...............................text....8.......:.................. ..`.rdata...W...P...X...>..............@..@.data...8=.......0..................@....pdata..(...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5292
Entropy (8bit):	5.115440205505611
Encrypted:	false
SSDEEP:	96:DxapqZink/QIHQIyzQIZQILuQIR8vtklGovxNx6sWwCvCCcTKvIrrg9BMM6VwDjz:sJnkoBs/sqLz8cTKvIrrUiM6VwDjyeWs
MD5:	137D13F917D94C83137A0FA5AE12B467
SHA1:	01E93402C225BF2A4EE59F9A06F8062CB5E4801E
SHA-256:	36738E6971D2F20DB78433185A0EF7912A48544AA6FF7006505A7DC785158859
SHA-512:	1B22CBC6E22FA5E2BD5CC4A370443A342D00E7DD53330A4000E9A680DE80262BCA7188764E3568944D01025188291602AC8C53C971630984FBD9FA7D75AAB124
Malicious:	false
Preview:	Metadata-Version: 2.1..Name: cryptography..Version: 41.0.7..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15334
Entropy (8bit):	5.552806309785179
Encrypted:	false
SSDEEP:	384:3X62U/ZfaigdSwJN5i6s7B0Ppzx6uvndLE4:3NUxfzgFthE4
MD5:	D88787EC6163B4F45579EA7CF7F56044
SHA1:	B241754AF16F5B2523DE1D07520DADB5ABA559BA
SHA-256:	E5265DE4206BAB1FB0C96212067AA1EB479C85AB0495B915938DDB365B0C948D
SHA-512:	F4F1C213458AC42A3417A870F7C6D2A125950F588C76F8A83D605242ABBDBCC2CBE70CA49A700710AA23AC143F2702963DEA48043C5CA86FBF0D3CE07126C696
Malicious:	false
Preview:	cryptography-41.0.7.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-41.0.7.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-41.0.7.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-41.0.7.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-41.0.7.dist-info/METADATA,sha256=NnOOaXHS8g23hDMYWg73kSpIVEqm_3AGUFp9x4UViFk,5292..cryptography-41.0.7.dist-info/RECORD,,..cryptography-41.0.7.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-41.0.7.dist-info/WHEEL,sha256=-EX5DQzNGQEoyL99Q-0P0-D-CXbfqafenaAeiSQ_Ufk,100..cryptography-41.0.7.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=uPXMbbcptt7EzZ_jllGRx0pVdMn-NBsAM4L74hOv-b0,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/_

C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.0203365408149025
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlbY3KgP+tkKc/SKQLn:RtBMwlVCxWKxDQLn
MD5:	4B432A99682DE414B29A683A3546B69F
SHA1:	F59C5016889EE5E9F62D09B22AEFBC2211A56C93
SHA-256:	F845F90D0CCD190128C8BF7D43ED0FD3E0FE0976DFA9A7DE9DA01E89243F51F9
SHA-512:	CBBF10E19B6F4072C416EA95D7AE259B9C5A1B89068B7B6660B7C637D6F2437AEA8D8202A2E26A0BEC36DAECD8BBB6B59016FC2DDEB13C545F0868B3E15479CA
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp37-abi3-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography-41.0.7.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.2389012566026314
Encrypted:	false
SSDEEP:	3:cOv:Nv
MD5:	E7274BD06FF93210298E7117D11EA631
SHA1:	7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
SHA-256:	28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
SHA-512:	AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
Malicious:	false
Preview:	cryptography.

C:\Users\user\AppData\Local\Temp\_MEI43442\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6673920
Entropy (8bit):	6.582002531606852
Encrypted:	false
SSDEEP:	98304:EzN+T+xtLlk0PPMAiGoTzeDy3x8lGBlWi9Nk:E5Y6Jk0PPMtfTzp3x8c
MD5:	486085AAC7BB246A173CEEA0879230AF
SHA1:	EF1095843B2A9C6D8285C7D9E8E334A9CE812FAE
SHA-256:	C3964FC08E4CA8BC193F131DEF6CC4B4724B18073AA0E12FED8B87C2E627DC83
SHA-512:	8A56774A08DA0AB9DD561D21FEBEEBC23A5DEA6F63D5638EA1B608CD923B857DF1F096262865E6EBD56B13EFD3BBA8D714FFDCE8316293229974532C49136460
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......QN.../.../.../...W(../......./......./......./......./...R.../...Z.../..^W.../.../...-../...",......./.../.../......./......./..Rich./..........PE..d...M7ee.........." ...&..M..........L...................................... f...........`......................................... .a.p.....a.\|............Pb..............Pe.p...p.[.T.....................[.(...0.[.@............0M..............................text.....M.......M................. ..`.rdata.......0M.......M.............@..@.data........0a.......a.............@....pdata.......Pb.......b.............@..@.reloc..p....Pe.......e.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5191960
Entropy (8bit):	5.962142634441191
Encrypted:	false
SSDEEP:	98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
MD5:	E547CF6D296A88F5B1C352C116DF7C0C
SHA1:	CAFA14E0367F7C13AD140FD556F10F320A039783
SHA-256:	05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE
SHA-512:	9F42EDF04C7AF350A00FA4FDF92B8E2E6F47AB9D2D41491985B20CD0ADDE4F694253399F6A88F4BDD765C4F49792F25FB01E84EC03FD5D0BE8BB61773D77D74D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l......l...m..l...i..l...h..l...o..l..m.y.l...m...l...o..l...h.l...l..l......l...n..l.Rich.l.........PE..d......e.........." ...%..7..4......v.........................................O.......P...`.........................................P.H.0....kN.@.....N.\|.....K.d.....O../....N....P.C.8.............................C.@............`N..............................text.....7.......7................. ..`.rdata....... 7.......7.............@..@.data....n....K..<....J.............@....pdata..0.....K......4K.............@..@.idata...%...`N..&....N.............@..@.00cfg..u.....N.......N.............@..@.rsrc...\|.....N......0N.............@..@.reloc........N......8N.............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	787224
Entropy (8bit):	5.609561366841894
Encrypted:	false
SSDEEP:	12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
MD5:	19A2ABA25456181D5FB572D88AC0E73E
SHA1:	656CA8CDFC9C3A6379536E2027E93408851483DB
SHA-256:	2E9FBCD8F7FDC13A5179533239811456554F2B3AA2FB10E1B17BE0DF81C79006
SHA-512:	DF17DC8A882363A6C5A1B78BA3CF448437D1118CCC4A6275CC7681551B13C1A4E0F94E30FFB94C3530B688B62BFF1C03E57C2C185A7DF2BF3E5737A06E114337
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>:V.PiV.PiV.Pi_..iX.PiC.QhT.Pi..QhT.PiC.UhZ.PiC.Th^.PiC.ShR.PillQhU.PiV.QiH.PillThf.PillPhW.Pill.iW.PillRhW.PiRichV.Pi................PE..d......e.........." ...%...........K........................................ ............`..........................................g...Q..............s.......@M......./......`.......8...........................`...@............p...............................text...D)......................... ..`.rdata..Hy...@...z..................@..@.data....N.......H..................@....pdata...V.......X..................@..@.idata...c...p...d...H..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..4...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.90551713971002
Encrypted:	false
SSDEEP:	1536:ZhseNxkc7Xva0Y420G1UD+dS4gBeLmRy:Z1kcbi0Y42bUD+dS4oeiRy
MD5:	01F9D30DD889A3519E3CA93FE6EFEE70
SHA1:	EBF55ADBD8CD938C4C11D076203A3E54D995AEFF
SHA-256:	A66444A08A8B9CEAFA05DAEFEB32AA1E65C8009A3C480599F648FA52A20AFB7D
SHA-512:	76FED302D62BB38A39E0BF6C9038730E83B6AFFFA2F36E7A62B85770D4847EA6C688098061945509A1FDB799FB7F5C88699F94E7DA1934F88A9C3B6A433EE9EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`T..$5..$5..$5..-M3..5..v@..&5..v@..(5..v@..,5..v@.. 5...k..&5..oM..55..$5...5...@..45...@..%5...@_.%5...@..%5..Rich$5..........................PE..d.....~e.........." .........h..............................................@............`.........................................P...`.......@.... .......................0..(.......................................8............................................text............................... ..`.rdata..\|I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	199448
Entropy (8bit):	6.385263095268062
Encrypted:	false
SSDEEP:	3072:gP9/HQAYp/8IdzL37lqrEJesY7p7Ndrjt8HWcFwUT6ZIALhNn6:opFYp/vdzL3pqrEJ2xDrJ8DdT6A
MD5:	F179C9BDD86A2A218A5BF9F0F1CF6CD9
SHA1:	4544FB23D56CC76338E7F71F12F58C5FE89D0D76
SHA-256:	C42874E2CF034FB5034F0BE35F7592B8A96E8903218DA42E6650C504A85B37CC
SHA-512:	3464ECE5C6A0E95EF6136897B70A96C69E552D28BFEDD266F13EEC840E36EC2286A1FB8973B212317DE6FE3E93D7D7CC782EB6FC3D6A2A8F006B34F6443498DE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W,.6B..6B..6B..N..6B..IC..6B..IG..6B..IF..6B..IA..6B...C..6B..NC..6B..6C..6B...O..6B...B..6B......6B...@..6B.Rich.6B.........PE..d......e.........." ...%.............................................................)....`......................................... ...P...p............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata..D.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\python3.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68376
Entropy (8bit):	6.14896460878624
Encrypted:	false
SSDEEP:	768:LV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/u:LDmF61JFn+/OHZIAL0R7SyHxy
MD5:	6271A2FE61978CA93E60588B6B63DEB2
SHA1:	BE26455750789083865FE91E2B7A1BA1B457EFB8
SHA-256:	A59487EA2C8723277F4579067248836B216A801C2152EFB19AFEE4AC9785D6FB
SHA-512:	8C32BCB500A94FF47F5EF476AE65D3B677938EBEE26E80350F28604AAEE20B044A5D55442E94A11CCD9962F34D22610B932AC9D328197CF4D2FFBC7DF640EFBA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T...5e..5e..5e..m..5e..e..5e.....5e..g..5e.Rich.5e.........PE..d......e.........." ...%............................................................x.....`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\python312.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7009048
Entropy (8bit):	5.7826778751744685
Encrypted:	false
SSDEEP:	49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WF4:mooCcqKLHX+az2Ro8Kv7HDMiEB/
MD5:	550288A078DFFC3430C08DA888E70810
SHA1:	01B1D31F37FB3FD81D893CC5E4A258E976F5884F
SHA-256:	789A42AC160CEF98F8925CB347473EEEB4E70F5513242E7FABA5139BA06EDF2D
SHA-512:	7244432FC3716F7EF27630D4E8FBC8180A2542AA97A01D44DCA260AB43966DD8AC98B6023400B0478A4809AACE1A128F1F4D6E544F2E591A5B436FD4C8A9D723
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T..e...e...e...d...e.......e...`...e...a...e...f...e.......e..d...e...d...e..Bh.M.e..Be...e..B....e..Bg...e.Rich..e.........................PE..d......e.........." ...%.$)..ZB......]........................................k.....:.k...`...........................................O.d...toP......Pj.......`.dZ....j../...`j.pZ....3.T.....................I.(...P.3.@............@)..............................text....")......$)................. ..`.rdata...T'..@)..V'..().............@..@.data....?....P......~P.............@....pdata..dZ....`..\....`.............@..@PyRuntim.....@c......\b.............@....rsrc........Pj......^i.............@..@.reloc..pZ...`j..\...hi.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\pywin32_system32\pywintypes312.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	5.9953900911096785
Encrypted:	false
SSDEEP:	3072:Yuh2G0a2fYrFceQaVK756Y/r06trvoEKQAe7KL8KJKVKGajt4:Yuh2faiYrFceQaVfY/rxTBAe7KwKwVrE
MD5:	26D752C8896B324FFD12827A5E4B2808
SHA1:	447979FA03F78CB7210A4E4BA365085AB2F42C22
SHA-256:	BD33548DBDBB178873BE92901B282BAD9C6817E3EAC154CA50A666D5753FD7EC
SHA-512:	99C87AB9920E79A03169B29A2F838D568CA4D4056B54A67BC51CAF5C0FF5A4897ED02533BA504F884C6F983EBC400743E6AD52AC451821385B1E25C3B1EBCEE0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.$g..wg..wg..wn.[wk..w5..vc..w..5wf..w5..vs..w5..vo..w5..vd..ws..vf..w...ve..ws..vl..wg..w...w...vj..w...vf..w...vf..wRichg..w........PE..d......d.........." ................L........................................P............`......................................... u..`B......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\select.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30488
Entropy (8bit):	6.582548725691534
Encrypted:	false
SSDEEP:	384:b9yLTFInPLnIdHqp3DT90IZIAQGyHQIYiSy1pCQ273bAM+o/8E9VF0Nypyn4:6inzUHqN1rZIAQGo5YiSyvUrAMxkEjh
MD5:	8A273F518973801F3C63D92AD726EC03
SHA1:	069FC26B9BD0F6EA3F9B3821AD7C812FD94B021F
SHA-256:	AF358285A7450DE6E2E5E7FF074F964D6A257FB41D9EB750146E03C7DDA503CA
SHA-512:	7FEDAE0573ECB3946EDE7D0B809A98ACAD3D4C95D6C531A40E51A31BDB035BADC9F416D8AAA26463784FF2C5E7A0CC2C793D62B5FDB2B8E9FAD357F93D3A65F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..t.s.'.s.'.s.'..7'.s.'...&.s.'...&.s.'...&.s.'...&.s.'(.&.s.'.s.'Ps.'Y..&.s.'(.&.s.'(.&.s.'(.['.s.'(.&.s.'Rich.s.'........PE..d......e.........." ...%.....2.......................................................y....`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1500440
Entropy (8bit):	6.5886408023548295
Encrypted:	false
SSDEEP:	24576:ATqtyGkxOc+wv05tP5kf82Hr/74YPF5o/P/gnAracr7/24UcypY7w0vpZUFq++I:nk0jwv4tP5kf8ar/74EF2/An4acrVUc2
MD5:	31CD2695493E9B0669D7361D92D46D94
SHA1:	19C1BC5C3856665ECA5390A2F9CD59B564C0139B
SHA-256:	17D547994008F1626BE2877497912687CB3EBD9A407396804310FD12C85AEAD4
SHA-512:	9DD8D1B900999E8CEA91F3D5F3F72D510F9CC28D7C6768A4046A9D2AA9E78A6ACE1248EC9574F5F6E53A6F1BDBFDF153D9BF73DBA05788625B03398716C87E1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......SJ...+...+...+...S...+...T...+...T...+...T...+...T...+..\S...+...+...+..-....+..-....+..-.n..+..-....+..Rich.+..................PE..d....Bre.........." ...%..................................................................`..........................................d...".............................../..........P...T...............................@...............@............................text...x........................... ..`.rdata..f...........................@..@.data....G.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1035728
Entropy (8bit):	6.630126944065657
Encrypted:	false
SSDEEP:	24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
MD5:	849959A003FA63C5A42AE87929FCD18B
SHA1:	D1B80B3265E31A2B5D8D7DA6183146BBD5FB791B
SHA-256:	6238CBFE9F57C142B75E153C399C478D492252FDA8CB40EE539C2DCB0F2EB232
SHA-512:	64958DABDB94D21B59254C2F074DB5D51E914DDBC8437452115DFF369B0C134E50462C3FDBBC14B6FA809A6EE19AB2FB83D654061601CC175CDDCB7D74778E09
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........of...5...5...5..5...5...5&..5...5...5...4...5...4...5...4...5...4...5...4..5...5...5...4...5Rich...5........PE..d.....$%.........." .....:..........0Z..............................................7^....`A................................................................. ...........!.............p........................... f..............................................text...09.......:.................. ..`.rdata..^....P.......>..............@..@.data....&..........................@....pdata....... ......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1137944
Entropy (8bit):	5.462202215180296
Encrypted:	false
SSDEEP:	12288:hrEHdcM6hbFCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciFt:hrEXYCjfk7bPNfv42BN6yzUiFt
MD5:	04F35D7EEC1F6B72BAB9DAF330FD0D6B
SHA1:	ECF0C25BA7ADF7624109E2720F2B5930CD2DBA65
SHA-256:	BE942308D99CC954931FE6F48ED8CC7A57891CCBE99AAE728121BCDA1FD929AB
SHA-512:	3DA405E4C1371F4B265E744229DCC149491A112A2B7EA8E518D5945F8C259CAD15583F25592B35EC8A344E43007AE00DA9673822635EE734D32664F65C9C8D9B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K..K..K..B.q.M..^..I..^..F..^..C..^..H..qE.H.....I..K.....qE.J..qE.J..qE..J..qE..J..RichK..........................PE..d......e.........." ...%.>..........`*.......................................p............`.........................................p...X............P.......@.........../...`......P^..T............................]..@............P..p............................text....=.......>.................. ..`.rdata..\....P.......B..............@..@.data...X.... ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.851293297484796
Encrypted:	false
SSDEEP:	3072:bPwB2zC1vwC3XetCf5RlRVFhLaNKPRyymoh5Lm9b0e:bIB2zkvwGXetCfDlRVlPRy85Lm9
MD5:	3A80FEA23A007B42CEF8E375FC73AD40
SHA1:	04319F7552EA968E2421C3936C3A9EE6F9CF30B2
SHA-256:	B70D69D25204381F19378E1BB35CC2B8C8430AA80A983F8D0E8E837050BB06EF
SHA-512:	A63BED03F05396B967858902E922B2FBFB4CF517712F91CFAA096FF0539CF300D6B9C659FFEE6BF11C28E79E23115FD6B9C0B1AA95DB1CBD4843487F060CCF40
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I^.f'..f'..f'......f'...&..f'...#..f'...$..f'.o.&..f'..."..f'...&..f'..f&..g'.o....f'.o.'..f'.o.%..f'.Rich.f'.................PE..d......d.........." .........................................................P............`..........................................................0..\....................@..$....v..T............................<..8............0..........@....................text...$........................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..$....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI43442\win32\win32crypt.pyd

Download File

Process:	C:\Users\user\Desktop\7EznMik8Fw.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	123904
Entropy (8bit):	5.966619585818369
Encrypted:	false
SSDEEP:	3072:07jbPA0SD9S3vrCqf93qMHxCjdLZn1Ya:07jtS9SfuCRCjFV
MD5:	47C91C74BB2C5CF696626AF04F3705AB
SHA1:	C086BC2825969756169FAB7DD2E560D360E1E09C
SHA-256:	F6EAD250FC2DE4330BD26079A44DED7F55172E05A70E28AD85D09E7881725155
SHA-512:	E6B6A4425B3E30CEA7BF8B09971FA0C84D6317B1A37BC1518266DC8D72C166099A8FC40A9B985300901BD921E444FF438FD30B814C1F1C6A051DF3471615C2BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U...U...U...\.v.S.......Q.......E.......].......V.....Q...A...R...U........\.....T.....T...RichU...........PE..d......d.........." ................(........................................ ............`..........................................o..................d.......................H....G..T............................H..8............................................text...~........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..............................@..@.rsrc...d...........................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.996486556715774
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7EznMik8Fw.exe
File size:	17'524'998 bytes
MD5:	a02bd3671b7dab9f036b13c8b0339714
SHA1:	9c48e8a80a0cf0a1ca1e4328091241c242dfc5b4
SHA256:	fc5586ca851cbf4eed21ae5c11b8e5d7c23379561016f779f5fe346439e2f55d
SHA512:	e9b5c9951b5f4d525e7932a7c0d509de690f1414c22934a215b4289bf812d0385a436eed6050d49cf5bb71cad105c9f3b668c7dbb6610a6288396e4234c5a65d
SSDEEP:	393216:UEkZgf8fdntpUTLfhJe1+TtIiFyuvB5IjWqJ6eoWez1HGwFXiWCR:URbFHUTLJE1QtItS3ILJ6e/UGhVR
TLSH:	74073347B3901CB1D2D1537E5262C56E6F63B894D361CB9F03B821A51F8B2634E3AE72
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?.......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?................

File Icon


Icon Hash:	02e4c2c63ccec224

Static PE Info

General

Entrypoint:	0x14000c1f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x65CAFC8C [Tue Feb 13 05:22:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	1af6c885af093afc55142c2f1761dbe8

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FE270C2348Ch
dec eax
add esp, 28h
jmp 00007FE270C2309Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FE270C23A04h
test eax, eax
je 00007FE270C23243h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FE270C23227h
dec eax
cmp ecx, eax
je 00007FE270C23236h
xor eax, eax
dec eax
cmpxchg dword ptr [0003427Ch], ecx
jne 00007FE270C23210h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FE270C23219h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [00034267h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [00034257h], al
call 00007FE270C23803h
call 00007FE270C24922h
test al, al
jne 00007FE270C23226h
xor al, al
jmp 00007FE270C23236h
call 00007FE270C318C1h
test al, al
jne 00007FE270C2322Bh
xor ecx, ecx
call 00007FE270C24932h
jmp 00007FE270C2320Ch
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003421Ch], 00000000h
mov ebx, ecx
jne 00007FE270C23289h
cmp ecx, 01h
jnbe 00007FE270C2328Ch
call 00007FE270C2396Ah
test eax, eax
je 00007FE270C2324Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3cdcc	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0x4634	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x42000	0x22a4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b000	0x75c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a330	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3a1f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x420	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29c90	0x29e00	62616acf257019688180f494b4eb78d4	False	0.5523087686567164	data	6.4831047330596565	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12bf4	0x12c00	331709545b6c1132fbe9c72b2db864ea	False	0.5184375	data	5.835042374763311	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x3338	0xe00	99d84572872f2ce8d9bdbc2521e1966e	False	0.1328125	Matlab v4 mat-file (little endian) f\324\377\3772\242\337-\231+, text, rows 4294967295, columns 0	1.8271683819747706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x42000	0x22a4	0x2400	39f0a7d8241a665fc55289b5f9977819	False	0.4720052083333333	data	5.316391891279308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x45000	0x15c	0x200	624222957a635749731104f8cdf6f9b7	False	0.38671875	data	2.83326547900447	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x46000	0x4634	0x4800	c5a3deb814c3970920fb8eac3139c247	False	0.138671875	data	2.9680759344437155	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4b000	0x75c	0x800	4138d4447f190c2657ec208ef31be551	False	0.5458984375	data	5.240127521097618	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x460e8	0x4028	Device independent bitmap graphic, 64 x 128 x 32, image size 0	0.10618606916707257
RT_GROUP_ICON	0x4a110	0x14	data	1.1
RT_MANIFEST	0x4a124	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	IsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 10:08:44.716468096 CET	49710	443	192.168.2.6	34.224.200.202
Dec 9, 2024 10:08:44.716531992 CET	443	49710	34.224.200.202	192.168.2.6
Dec 9, 2024 10:08:44.716659069 CET	49710	443	192.168.2.6	34.224.200.202
Dec 9, 2024 10:08:46.605950117 CET	49710	443	192.168.2.6	34.224.200.202
Dec 9, 2024 10:08:46.605993986 CET	443	49710	34.224.200.202	192.168.2.6
Dec 9, 2024 10:08:48.344639063 CET	443	49710	34.224.200.202	192.168.2.6
Dec 9, 2024 10:08:48.345293999 CET	49710	443	192.168.2.6	34.224.200.202
Dec 9, 2024 10:08:48.345309019 CET	443	49710	34.224.200.202	192.168.2.6
Dec 9, 2024 10:08:48.346226931 CET	443	49710	34.224.200.202	192.168.2.6
Dec 9, 2024 10:08:48.346286058 CET	49710	443	192.168.2.6	34.224.200.202
Dec 9, 2024 10:08:48.347567081 CET	49710	443	192.168.2.6	34.224.200.202
Dec 9, 2024 10:08:48.347693920 CET	49710	443	192.168.2.6	34.224.200.202

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 10:08:44.576170921 CET	59713	53	192.168.2.6	1.1.1.1
Dec 9, 2024 10:08:44.713227034 CET	53	59713	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 10:08:44.576170921 CET	192.168.2.6	1.1.1.1	0x7104	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 10:08:44.713227034 CET	1.1.1.1	192.168.2.6	0x7104	No error (0)	httpbin.org		34.224.200.202	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:08:44.713227034 CET	1.1.1.1	192.168.2.6	0x7104	No error (0)	httpbin.org		44.196.3.45	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	04:08:39
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\7EznMik8Fw.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\7EznMik8Fw.exe"
Imagebase:	0x7ff682e80000
File size:	17'524'998 bytes
MD5 hash:	A02BD3671B7DAB9F036B13C8B0339714
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	04:08:42
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\7EznMik8Fw.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\7EznMik8Fw.exe"
Imagebase:	0x7ff682e80000
File size:	17'524'998 bytes
MD5 hash:	A02BD3671B7DAB9F036B13C8B0339714
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13%
Total number of Nodes:	2000
Total number of Limit Nodes:	23

Executed Functions

Function 00007FF682EA6370 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF682EA63B5

Part of subcall function 00007FF682EA5D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA5D1C

Part of subcall function 00007FF682E9AF0C: RtlFreeHeap.NTDLL(?,?,?,00007FF682EA3392,?,?,?,00007FF682EA33CF,?,?,00000000,00007FF682EA3895,?,?,00000000,00007FF682EA37C7), ref: 00007FF682E9AF22
Part of subcall function 00007FF682E9AF0C: GetLastError.KERNEL32(?,?,?,00007FF682EA3392,?,?,?,00007FF682EA33CF,?,?,00000000,00007FF682EA3895,?,?,00000000,00007FF682EA37C7), ref: 00007FF682E9AF2C

Part of subcall function 00007FF682E9AEC4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF682E9AEA3,?,?,?,?,?,00007FF682E930CC), ref: 00007FF682E9AECD
Part of subcall function 00007FF682E9AEC4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF682E9AEA3,?,?,?,?,?,00007FF682E930CC), ref: 00007FF682E9AEF2

_get_daylight.LIBCMT ref: 00007FF682EA63A4

Part of subcall function 00007FF682EA5D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA5D7C

_get_daylight.LIBCMT ref: 00007FF682EA661A
_get_daylight.LIBCMT ref: 00007FF682EA662B
_get_daylight.LIBCMT ref: 00007FF682EA663C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF682EA687C), ref: 00007FF682EA6663

Strings

Eastern Summer Time, xrefs: 00007FF682EA6721
Eastern Standard Time, xrefs: 00007FF682EA6709

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
Instruction ID: 8e9287d4b05ecb88fa73ff73a3c929a430f16936040a73039d7768ba77da9f94
Opcode Fuzzy Hash: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
Instruction Fuzzy Hash: 90D1F466E18202C6EB24DF21D4581B927A1FFA5B8CF40413DEA4ED7A89DFBCE441C748

Function 00007FF682EA72BC Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF682EA6FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA7031
Part of subcall function 00007FF682EA6FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA70AF
Part of subcall function 00007FF682EA6FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA7100

CreateFileW.KERNELBASE ref: 00007FF682EA73C2
CreateFileW.KERNEL32 ref: 00007FF682EA7412
GetLastError.KERNEL32 ref: 00007FF682EA7442
GetFileType.KERNELBASE ref: 00007FF682EA7457
GetLastError.KERNEL32 ref: 00007FF682EA7461
CloseHandle.KERNEL32 ref: 00007FF682EA7494
CloseHandle.KERNEL32 ref: 00007FF682EA75F7
CreateFileW.KERNEL32 ref: 00007FF682EA762C
GetLastError.KERNEL32 ref: 00007FF682EA763B

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
Instruction ID: 99f600d28d5be90c13a3004ab5abb51b9814472d340fea5a0420daacbf211c65
Opcode Fuzzy Hash: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
Instruction Fuzzy Hash: 9AC1A032B24A42D5EB50CF68C4942AD3B71FB99B98B01422DDE2FAB395CF78D456C344

Function 00007FF682E87950 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF682E8154F), ref: 00007FF682E879E7

Part of subcall function 00007FF682E87B60: GetEnvironmentVariableW.KERNEL32(00007FF682E83A1F), ref: 00007FF682E87B9A
Part of subcall function 00007FF682E87B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF682E87BB7

Part of subcall function 00007FF682E97DEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682E97E05

SetEnvironmentVariableW.KERNEL32 ref: 00007FF682E87AA1

Part of subcall function 00007FF682E82B30: MessageBoxW.USER32 ref: 00007FF682E82C05

Strings

LOADER: Failed to set the TMP environment variable., xrefs: 00007FF682E879CA
TMP, xrefs: 00007FF682E879B0
_MEI%d, xrefs: 00007FF682E879F5
TMP, xrefs: 00007FF682E8798A, 00007FF682E87A49, 00007FF682E87AD7

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: d0ee005bfdeb011a84540aff6346199bb1fc02b76f4ac94b865217064e0c6b04
Instruction ID: 0fd330db3dd3d7959884b09c6c215cb9d82441764afca180f40222368c427d8d
Opcode Fuzzy Hash: d0ee005bfdeb011a84540aff6346199bb1fc02b76f4ac94b865217064e0c6b04
Instruction Fuzzy Hash: AC51F520B5D243D1FE54A762A86D2BA52917F89BC8F04403EED4EC77D3DEACE501C208

Function 00007FF682EA65EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF682EA661A

Part of subcall function 00007FF682EA5D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA5D7C

_get_daylight.LIBCMT ref: 00007FF682EA662B

Part of subcall function 00007FF682EA5D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA5D1C

_get_daylight.LIBCMT ref: 00007FF682EA663C

Part of subcall function 00007FF682EA5D38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA5D4C

Part of subcall function 00007FF682E9AF0C: RtlFreeHeap.NTDLL(?,?,?,00007FF682EA3392,?,?,?,00007FF682EA33CF,?,?,00000000,00007FF682EA3895,?,?,00000000,00007FF682EA37C7), ref: 00007FF682E9AF22
Part of subcall function 00007FF682E9AF0C: GetLastError.KERNEL32(?,?,?,00007FF682EA3392,?,?,?,00007FF682EA33CF,?,?,00000000,00007FF682EA3895,?,?,00000000,00007FF682EA37C7), ref: 00007FF682E9AF2C

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF682EA687C), ref: 00007FF682EA6663

Strings

Eastern Summer Time, xrefs: 00007FF682EA6721
Eastern Standard Time, xrefs: 00007FF682EA6709

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
Instruction ID: 8550b92067af8bd57747c9782fbe996dd6eda97fcf628b2b59e4f4cb740859e1
Opcode Fuzzy Hash: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
Instruction Fuzzy Hash: 6351B136E18642C6E720DF21E8985A96761FF58B8CF40413DEA4ED7A95DFBCE401CB48

Function 00007FF682E81710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to write data chunk!, xrefs: 00007FF682E818E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF682E817D9
fseek, xrefs: 00007FF682E8180D
malloc, xrefs: 00007FF682E8186D
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF682E81866
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF682E818F5
Failed to create symbolic link %s!, xrefs: 00007FF682E81753
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF682E81726
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF682E81806
fopen, xrefs: 00007FF682E81797
Failed to extract %s: failed to open target file!, xrefs: 00007FF682E81790
fwrite, xrefs: 00007FF682E818EC
fread, xrefs: 00007FF682E818FC

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: 87343fe10619d9e83b33ad50ad85e1553a80dad7a26c37df04226b889a4fe075
Instruction ID: 99103dc2cee6bb2fefbeb13db3eb0a41bc31796450bb007b5c7f6b762a4c5d15
Opcode Fuzzy Hash: 87343fe10619d9e83b33ad50ad85e1553a80dad7a26c37df04226b889a4fe075
Instruction Fuzzy Hash: FE51DF61B58642C6EB109B25E8582B963A0BF55B9CF40413DEE8DCB695DFBCE244C708

Function 00007FF682E88950 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0000000100000001,00007FF682E8414C,00007FF682E87911,?,00007FF682E87D26,?,00007FF682E81785), ref: 00007FF682E88990
OpenProcessToken.ADVAPI32(?,00007FF682E87D26,?,00007FF682E81785), ref: 00007FF682E889A1
GetTokenInformation.KERNELBASE(?,00007FF682E87D26,?,00007FF682E81785), ref: 00007FF682E889C3
GetLastError.KERNEL32(?,00007FF682E87D26,?,00007FF682E81785), ref: 00007FF682E889CD
GetTokenInformation.KERNELBASE(?,00007FF682E87D26,?,00007FF682E81785), ref: 00007FF682E88A0A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF682E88A1C
CloseHandle.KERNELBASE(?,00007FF682E87D26,?,00007FF682E81785), ref: 00007FF682E88A34
LocalFree.KERNEL32(?,00007FF682E87D26,?,00007FF682E81785), ref: 00007FF682E88A66
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF682E88A8D
CreateDirectoryW.KERNELBASE(?,00007FF682E87D26,?,00007FF682E81785), ref: 00007FF682E88A9E

Strings

D:(A;;FA;;;%s), xrefs: 00007FF682E88A49
S-1-3-4, xrefs: 00007FF682E88A3F

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 277e46be752bec10122730c01fa2f416892ba719bf6bded195714ae853bd66f0
Instruction ID: c0c78696db5fbfc83fa48678bcec2fd821881965f89e418dd88c781042abdedf
Opcode Fuzzy Hash: 277e46be752bec10122730c01fa2f416892ba719bf6bded195714ae853bd66f0
Instruction Fuzzy Hash: C841B031618686C2EB50CF60E4886AA6360FF94798F44023DEA9EC7AE5DFBCE404C704

Function 00007FF682E81AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF682E882B0: _fread_nolock.LIBCMT ref: 00007FF682E8835A

_fread_nolock.LIBCMT ref: 00007FF682E81B54

Part of subcall function 00007FF682E82890: MessageBoxW.USER32 ref: 00007FF682E8299B

Strings

Could not allocate buffer for TOC!, xrefs: 00007FF682E81BD6
Failed to read cookie!, xrefs: 00007FF682E81B5F
Error on file., xrefs: 00007FF682E81C36
Could not read full TOC!, xrefs: 00007FF682E81C09
fseek, xrefs: 00007FF682E81B33
fread, xrefs: 00007FF682E81B66, 00007FF682E81C10
Failed to seek to cookie position!, xrefs: 00007FF682E81B2C
malloc, xrefs: 00007FF682E81BDD
MEI, xrefs: 00007FF682E81AE2

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: 885a60bfd35d189cc9b4b7bd662c89924dd8b692e04ef3321e80749b8243a107
Instruction ID: ec78d0f841721a743f3e43545f8366b3b5fb368400986b814f96f1bf020f717f
Opcode Fuzzy Hash: 885a60bfd35d189cc9b4b7bd662c89924dd8b692e04ef3321e80749b8243a107
Instruction Fuzzy Hash: EF518D71A19642C6EB18CF28E4581B833A0FF58B8CB55853EDA4DC7799DEBCE440CB48

Function 00007FF682E88080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF682E88AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF682E82ABB), ref: 00007FF682E88B1A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF682E83D52), ref: 00007FF682E880CF
GetStartupInfoW.KERNEL32 ref: 00007FF682E880EE

Part of subcall function 00007FF682E9AA14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682E9AA28

Part of subcall function 00007FF682E98630: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682E98697

GetCommandLineW.KERNEL32 ref: 00007FF682E8818E
CreateProcessW.KERNELBASE ref: 00007FF682E881D0
WaitForSingleObject.KERNEL32 ref: 00007FF682E881E4
GetExitCodeProcess.KERNEL32 ref: 00007FF682E881F4

Strings

Error creating child process!, xrefs: 00007FF682E88200
CreateProcessW, xrefs: 00007FF682E88207

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
Instruction ID: 3d193e021168b8fe576ad2ad7b8e3a304be8caea889e7f58cb7ceaca20c4eda2
Opcode Fuzzy Hash: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
Instruction Fuzzy Hash: A7412471A08785C2DA20DB64E4592AAB360FFA5364F50073EEAAD877E5DFBCD054CB04

Function 00007FF682E81000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF682E83EC0: GetModuleFileNameW.KERNEL32(?,00007FF682E839EA), ref: 00007FF682E83EF1

SetDllDirectoryW.KERNEL32 ref: 00007FF682E83BE9

Part of subcall function 00007FF682E87B60: GetEnvironmentVariableW.KERNEL32(00007FF682E83A1F), ref: 00007FF682E87B9A
Part of subcall function 00007FF682E87B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF682E87BB7

Strings

_MEIPASS2, xrefs: 00007FF682E83A0B, 00007FF682E83A74, 00007FF682E83D22, 00007FF682E83D2E
Failed to convert DLL search path!, xrefs: 00007FF682E83BD1
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF682E83B60
_PYI_ONEDIR_MODE, xrefs: 00007FF682E83A34, 00007FF682E83A5F
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF682E83AC6
MEI, xrefs: 00007FF682E83B1B

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: bc804580661d330fd68571be0a8a6f4046a9eb4bd7f0ff81acb8572ffe878501
Instruction ID: 6169b1c9a2536f88f15a730ca0bbeff4a28064cc55f85055f77cddedbf373a53
Opcode Fuzzy Hash: bc804580661d330fd68571be0a8a6f4046a9eb4bd7f0ff81acb8572ffe878501
Instruction Fuzzy Hash: F7B1B261B5C686C1EE25AB21D5582FD23A0BF5878CF44013DEE9DC7696EFACE501C708

Function 00007FF682E81050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF682E81249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF682E810B4
malloc, xrefs: 00007FF682E810F8, 00007FF682E81126
1.2.13, xrefs: 00007FF682E8107E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF682E8111F
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF682E810F1

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 7739cbabc253cc6e8f59069b699201d0862b4b88c7660801c14c8af0229557fd
Instruction ID: ec32c7fdf3868de0eebb77a8b021d3667ec0db99b627b55b1445580ce0f3cf2f
Opcode Fuzzy Hash: 7739cbabc253cc6e8f59069b699201d0862b4b88c7660801c14c8af0229557fd
Instruction Fuzzy Hash: 84510162A58682C5EB209B55E4483BA6290FF8479CF44413EED8ECB795EFBCE504C708

Function 00007FF682E9C01C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E9C449

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
Instruction ID: bace4ce6a1fd1c05f4337beaf03778c388a271f5f04bde21b6b8fc9f1355d5be
Opcode Fuzzy Hash: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
Instruction Fuzzy Hash: 2EC1D422A08B86D1E650AB5584483BD3B94FF99B88F55113EDE4E87391CEBCE465C708

Function 00007FF682E9D520 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF682E9D50B), ref: 00007FF682E9D63C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF682E9D50B), ref: 00007FF682E9D6C7

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
Instruction ID: 3b2ebe57ffe9e6ec8951b4278f3c46018154298d98b10adf667ce9904545ed1b
Opcode Fuzzy Hash: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
Instruction Fuzzy Hash: E391D672E18661C5F760AF6994482BD2BA0BF54B8CF14413EDE8EA7686CFB8D491C304

Function 00007FF682E9FCEC Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF682E9FDDC
_get_daylight.LIBCMT ref: 00007FF682E9FDED
_get_daylight.LIBCMT ref: 00007FF682E9FDFE
_isindst.LIBCMT ref: 00007FF682E9FEC9

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
Instruction ID: 01813880b1958ff0f5c36c0233fd33a4b02aa349e355ab306459595e2f83a0f2
Opcode Fuzzy Hash: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
Instruction Fuzzy Hash: 8351C272F04212CAEB24CF2499596BC37A5BF1036CF51123EED1E92AE5DF78A452C704

Function 00007FF682E95854 Relevance: 6.1, APIs: 4, Instructions: 119
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FF682E95887
GetFileInformationByHandle.KERNELBASE ref: 00007FF682E958E9
GetLastError.KERNEL32 ref: 00007FF682E9597A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF682E9578C), ref: 00007FF682E959C6

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: a7b857db6b01e19318b34c0e1f4ae245464e2a3bbbae32caf4e8ae7d5ae051c5
Instruction ID: cf618fa53e0ce2aad6a66ae364a40117bef26fe8deb346bd0a540fada4669084
Opcode Fuzzy Hash: a7b857db6b01e19318b34c0e1f4ae245464e2a3bbbae32caf4e8ae7d5ae051c5
Instruction Fuzzy Hash: 10519C62A08645CAFB10CF60D4543BD23A1BF58B6CF14853EDE5D97689DFB8D4A1C708

Function 00007FF682E8C07C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF682E8C08B

Part of subcall function 00007FF682E8C24C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF682E8C26E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF682E8C0A0
__scrt_release_startup_lock.LIBCMT ref: 00007FF682E8C10E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF682E8C161

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
Instruction ID: fe352960bc5d2a3a1305286eb18ccd129ba2cb2141046c131d30b701a550e24f
Opcode Fuzzy Hash: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
Instruction Fuzzy Hash: 4E314C11A88543C1FA28AB64D4993B923A1BF6678CF44603DDD8EC72D7DEACB405C21D

Function 00007FF682E95700 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E9572D
CreateFileW.KERNELBASE ref: 00007FF682E9576C
CloseHandle.KERNEL32 ref: 00007FF682E957A1

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
Instruction ID: 75e3a312f2216533ad194d394db0cb176db6aff60a231ff01539b455bf25fd05
Opcode Fuzzy Hash: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
Instruction Fuzzy Hash: E5418162D18786C3E7608B2095183A96360FFA5768F10933EEA9D47AD5DFBCA5F0C704

Function 00007FF682E9027C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E902C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E903B7

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2f7bb398de8c4fd3266a2cb5114fed605c2779b223882c17691b198031e80610
Instruction ID: 50c53b2e069d2ca9d5b8dee2f06103a66439ac9633dedb783b3af0aa1d920255
Opcode Fuzzy Hash: 2f7bb398de8c4fd3266a2cb5114fed605c2779b223882c17691b198031e80610
Instruction Fuzzy Hash: 2851F421B09651C6EA68DE36D4086BA62C1BF45BACF54463EDD6CC77C6CEBCE460C608

Function 00007FF682E9C6F4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF682E9C88D), ref: 00007FF682E9C740
GetLastError.KERNEL32(?,?,?,?,?,00007FF682E9C88D), ref: 00007FF682E9C74A

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
Instruction ID: 222eba5094c1013815e29a729ef8589e75d63ecbbfa0ef85b48f75af44772cca
Opcode Fuzzy Hash: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
Instruction Fuzzy Hash: 68112261608A81C1DA109B35A4081696361BF54BF8F54133EEEBD877D9CFBCD021C704

Function 00007FF682E959FC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF682E95911), ref: 00007FF682E95A2F
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF682E95911), ref: 00007FF682E95A45

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
Instruction ID: c040eb12bed202ab2e748ae464a650a53cdbcd7fa79300a4374a72b3624fb52c
Opcode Fuzzy Hash: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
Instruction Fuzzy Hash: B0116D7260C646C1EB548B11A45517AB7A0FF85765F50023EFAAEC59E8EFACD058CB08

Function 00007FF682E9AF0C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF682EA3392,?,?,?,00007FF682EA33CF,?,?,00000000,00007FF682EA3895,?,?,00000000,00007FF682EA37C7), ref: 00007FF682E9AF22
GetLastError.KERNEL32(?,?,?,00007FF682EA3392,?,?,?,00007FF682EA33CF,?,?,00000000,00007FF682EA3895,?,?,00000000,00007FF682EA37C7), ref: 00007FF682E9AF2C

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
Instruction ID: e07a81e031df298303b10cada31818f4097ea71f1d1345b96f10ab058a3d7440
Opcode Fuzzy Hash: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
Instruction Fuzzy Hash: 6EE0CD91F08206C2FF64ABF2544D17511917FA4B09F40443DCC0FD7392DEEC68A5C218

Function 00007FF682E9B11C Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF682E9AF99,?,?,00000000,00007FF682E9B04E), ref: 00007FF682E9B18A
GetLastError.KERNEL32(?,?,?,00007FF682E9AF99,?,?,00000000,00007FF682E9B04E), ref: 00007FF682E9B194

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
Instruction ID: 05e9bd6d02adc8a6c8d0badb336b75b6c58fbb6132dd23d60f2a46ea1ff23005
Opcode Fuzzy Hash: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
Instruction Fuzzy Hash: 76210161B18282C1FA90C762948C27D22827F90BA8F04423FDA5EC73D2CEECA465C618

Function 00007FF682E9C46C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E9C494

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6c27d5487ee8182774302d92aae2f9046d2b98e9277a8b83ca44002d61502fcf
Instruction ID: 3687e78a31bc85b9ccc9ec62201608bd505f6f361dce2ea5377a8ad609dddb44
Opcode Fuzzy Hash: 6c27d5487ee8182774302d92aae2f9046d2b98e9277a8b83ca44002d61502fcf
Instruction Fuzzy Hash: A241A172A08241C7EB34EA29E54827977A0FF5AB49F10153EDA8EC3791CFACE412C755

Function 00007FF682E882B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF682E8835A

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 769c694078216e3e967d8c6fbad097522bcbd76ef7f427309f5f9921e1c76582
Instruction ID: d204ee7863dd8c52f0f9a34865fc286593c6e33a848b3a3de250e85f639b91f2
Opcode Fuzzy Hash: 769c694078216e3e967d8c6fbad097522bcbd76ef7f427309f5f9921e1c76582
Instruction Fuzzy Hash: 0221EA21B48296C5FB50DB12A4087FA6651BF45BDCF8C503DEE8D87786CEBCE001C208

Function 00007FF682E9BEFC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E9BF82

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf493e245973df117cfb9bdb4be30e1b7cc3e093745a0bb3aa436662ba277ffd
Instruction ID: d5d26d75a7f587fa89ef09dd65a873ae02bc1e7c1b5db855650b699fecdefd87
Opcode Fuzzy Hash: cf493e245973df117cfb9bdb4be30e1b7cc3e093745a0bb3aa436662ba277ffd
Instruction Fuzzy Hash: E731A062A18616C5F751EB56C8493BC2A50BF80BA9F41013FEA1D873D2CEFCE461CB19

Function 00007FF682E964A8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E9640D

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction ID: 150495c1d6b407f36bc43d77b0802d4ee49aae38f6f96c6c3b384af7128fb73e
Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction Fuzzy Hash: 67115121A1C641C1EE60DF51D40527AA2A4BF96B88F04443FEA8DD7B8ADFBCD460DB48

Function 00007FF682EA6CAC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA6CCF

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
Instruction ID: 3bfc06970f97b7060d7ec951329896ee22e50d95133b109934032028a257312b
Opcode Fuzzy Hash: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
Instruction Fuzzy Hash: 7E21C232A18A41C6DB618F19E4443B976B0FF95B98F14423CEA5E876D9DF7CD800CB04

Function 00007FF682E904FC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E90550

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction ID: 9542008c26af4236e4f6149ee7bd5cbced3acdfd1829cfa967512d36d9ac6887
Opcode Fuzzy Hash: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction Fuzzy Hash: BD01E561A08745C0EA10DB66D90406DA795BF85FE4F48423EDE5C93BDACEBCD021C304

Function 00007FF682E9F158 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF682E9B9A6,?,?,?,00007FF682E9AB67,?,?,00000000,00007FF682E9AE02), ref: 00007FF682E9F1AD

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
Instruction ID: 3211a9086db32b8361ced82c218a753b273991f8bc1c435201228b43c693e2a5
Opcode Fuzzy Hash: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
Instruction Fuzzy Hash: A0F06D55B09206C1FE949662D9182B962917F98B58F4C443ECD0EC63C3DEDCE4A0CAB8

Function 00007FF682E9DBBC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF682E90D24,?,?,?,00007FF682E92236,?,?,?,?,?,00007FF682E93829), ref: 00007FF682E9DBFA

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
Instruction ID: cc9ce9f98dd66bf36c2c3e68487c08983490fa92cc2fe9ec050dec15c9356712
Opcode Fuzzy Hash: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
Instruction Fuzzy Hash: F2F05E40B0C25AC5FE54666198182B512907F44768F08063DD86EC62C2DDDCA4A0C128

Non-executed Functions

Function 00007FF682E851E0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF682E8346E), ref: 00007FF682E851F0
GetProcAddress.KERNEL32(?,?,00000000,00007FF682E8346E), ref: 00007FF682E8522A
GetProcAddress.KERNEL32(?,?,00000000,00007FF682E8346E), ref: 00007FF682E8524F
GetProcAddress.KERNEL32(?,?,00000000,00007FF682E8346E), ref: 00007FF682E85274
GetProcAddress.KERNEL32(?,?,00000000,00007FF682E8346E), ref: 00007FF682E8529C
GetProcAddress.KERNEL32(?,?,00000000,00007FF682E8346E), ref: 00007FF682E852C4
GetProcAddress.KERNEL32(?,?,00000000,00007FF682E8346E), ref: 00007FF682E852EC
GetProcAddress.KERNEL32(?,?,00000000,00007FF682E8346E), ref: 00007FF682E85314
GetProcAddress.KERNEL32(?,?,00000000,00007FF682E8346E), ref: 00007FF682E8533C
GetProcAddress.KERNEL32(?,?,00000000,00007FF682E8346E), ref: 00007FF682E85364

Strings

Failed to get address for PySys_SetObject, xrefs: 00007FF682E857AE
PySys_GetObject, xrefs: 00007FF682E8576A
PyUnicode_Replace, xrefs: 00007FF682E858AA
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF682E853EE
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF682E856F2
Failed to get address for PyMem_RawFree, xrefs: 00007FF682E855F6
PyUnicode_DecodeFSDefault, xrefs: 00007FF682E8580A
PyMem_RawFree, xrefs: 00007FF682E855DA
Failed to get address for PyList_Append, xrefs: 00007FF682E855A6
Failed to get address for Py_ExitStatusException, xrefs: 00007FF682E85261
Failed to get address for PyConfig_SetString, xrefs: 00007FF682E853C6
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF682E852AE
PyImport_AddModule, xrefs: 00007FF682E85512
Failed to get address for PyErr_Restore, xrefs: 00007FF682E854DE
Failed to get address for PyObject_CallFunction, xrefs: 00007FF682E85646
Failed to get address for PyUnicode_FromString, xrefs: 00007FF682E85876
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF682E8534E
PyUnicode_AsUTF8, xrefs: 00007FF682E857BA
PyStatus_Exception, xrefs: 00007FF682E85742
Failed to get address for PyUnicode_Join, xrefs: 00007FF682E8589E
PyObject_CallFunctionObjArgs, xrefs: 00007FF682E85652
GetProcAddress, xrefs: 00007FF682E85209
Failed to get address for PyConfig_Read, xrefs: 00007FF682E85376
Failed to get address for PyEval_EvalCode, xrefs: 00007FF682E85506
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF682E85556
PyConfig_SetWideStringList, xrefs: 00007FF682E853D2
Failed to get address for PyUnicode_Replace, xrefs: 00007FF682E858C6
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF682E857D6
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF682E85696
Failed to get address for Py_Finalize, xrefs: 00007FF682E85286
Py_InitializeFromConfig, xrefs: 00007FF682E85292
Py_DecRef, xrefs: 00007FF682E851E6
PySys_SetObject, xrefs: 00007FF682E85792
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF682E85736
PyEval_EvalCode, xrefs: 00007FF682E854EA
Failed to get address for PyConfig_Clear, xrefs: 00007FF682E85326
Failed to get address for PyObject_Str, xrefs: 00007FF682E856E6
Failed to get address for Py_DecodeLocale, xrefs: 00007FF682E8523C
PyConfig_Clear, xrefs: 00007FF682E8530A
Failed to get address for PyImport_AddModule, xrefs: 00007FF682E8552E
PyObject_Str, xrefs: 00007FF682E856CA
PyUnicode_Decode, xrefs: 00007FF682E857E2
Failed to get address for Py_DecRef, xrefs: 00007FF682E85202
Failed to get address for PyStatus_Exception, xrefs: 00007FF682E8575E
Failed to get address for PyErr_Print, xrefs: 00007FF682E854B6
PyObject_SetAttrString, xrefs: 00007FF682E856A2
Py_DecodeLocale, xrefs: 00007FF682E85220
Failed to get address for PySys_GetObject, xrefs: 00007FF682E85786
PyRun_SimpleStringFlags, xrefs: 00007FF682E8571A
PyErr_NormalizeException, xrefs: 00007FF682E8544A
Failed to get address for PyErr_Clear, xrefs: 00007FF682E85416
Failed to get address for Py_PreInitialize, xrefs: 00007FF682E852FE
PyUnicode_Join, xrefs: 00007FF682E85882
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF682E8566E
PyImport_ExecCodeModule, xrefs: 00007FF682E8553A
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF682E855CE
PyList_Append, xrefs: 00007FF682E8558A
Failed to get address for PyModule_GetDict, xrefs: 00007FF682E8561E
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF682E8584E
PyConfig_InitIsolatedConfig, xrefs: 00007FF682E85332
Failed to get address for PyImport_ImportModule, xrefs: 00007FF682E8557E
Failed to get address for PyErr_Occurred, xrefs: 00007FF682E8548E
PyUnicode_FromFormat, xrefs: 00007FF682E85832
Failed to get address for Py_IsInitialized, xrefs: 00007FF682E852D6
PyImport_ImportModule, xrefs: 00007FF682E85562
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF682E8539E
PyConfig_SetString, xrefs: 00007FF682E853AA
Py_ExitStatusException, xrefs: 00007FF682E85245
Py_IsInitialized, xrefs: 00007FF682E852BA
PyErr_Print, xrefs: 00007FF682E8549A
PyConfig_SetBytesString, xrefs: 00007FF682E85382
PyErr_Fetch, xrefs: 00007FF682E85422
PyErr_Restore, xrefs: 00007FF682E854C2
PyObject_GetAttrString, xrefs: 00007FF682E8567A
Py_PreInitialize, xrefs: 00007FF682E852E2
PyMarshal_ReadObjectFromString, xrefs: 00007FF682E855B2
Py_Finalize, xrefs: 00007FF682E8526A
PyModule_GetDict, xrefs: 00007FF682E85602
PyObject_CallFunction, xrefs: 00007FF682E8562A
PyErr_Clear, xrefs: 00007FF682E853FA
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF682E85466
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF682E856BE
PyUnicode_FromString, xrefs: 00007FF682E8585A
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF682E85826
Failed to get address for PyErr_Fetch, xrefs: 00007FF682E8543E
PyErr_Occurred, xrefs: 00007FF682E85472
Failed to get address for PyUnicode_Decode, xrefs: 00007FF682E857FE
PyConfig_Read, xrefs: 00007FF682E8535A
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF682E8570E

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
Instruction ID: be642eb8f0c26d72c50faae04aa5e5e16cc86bbe8fd2eb458858ae0af74a75b3
Opcode Fuzzy Hash: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
Instruction Fuzzy Hash: 1D12CF64A4AB07D4FB55CB18A89817027B1BF29748B85643DC85FE62A4FFFCB548C20C

Function 00007FF682E81F50 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF682E81F9E
MulDiv.KERNEL32 ref: 00007FF682E81FB2
MulDiv.KERNEL32 ref: 00007FF682E81FD3
SystemParametersInfoW.USER32 ref: 00007FF682E8201B
CreateFontIndirectW.GDI32 ref: 00007FF682E8202F
#380.COMCTL32 ref: 00007FF682E82053
CreateWindowExW.USER32 ref: 00007FF682E820A6
CreateWindowExW.USER32 ref: 00007FF682E82100
CreateWindowExW.USER32 ref: 00007FF682E8215D
CreateWindowExW.USER32 ref: 00007FF682E821BF
SendMessageW.USER32 ref: 00007FF682E821DF
SendMessageW.USER32 ref: 00007FF682E821F9
SendMessageW.USER32 ref: 00007FF682E82218
SendMessageW.USER32 ref: 00007FF682E82237
SendMessageW.USER32 ref: 00007FF682E82255
SendMessageW.USER32 ref: 00007FF682E82273
SendMessageW.USER32 ref: 00007FF682E82291
SendMessageW.USER32 ref: 00007FF682E822A9
SendMessageW.USER32 ref: 00007FF682E822C1
GetClientRect.USER32 ref: 00007FF682E822D0

Part of subcall function 00007FF682E823F0: GetDC.USER32 ref: 00007FF682E8241B
Part of subcall function 00007FF682E823F0: SelectObject.GDI32 ref: 00007FF682E82462
Part of subcall function 00007FF682E823F0: DrawTextW.USER32 ref: 00007FF682E82485
Part of subcall function 00007FF682E823F0: SelectObject.GDI32 ref: 00007FF682E8249B
Part of subcall function 00007FF682E823F0: ReleaseDC.USER32 ref: 00007FF682E824AB
Part of subcall function 00007FF682E823F0: MoveWindow.USER32 ref: 00007FF682E824FB
Part of subcall function 00007FF682E823F0: MoveWindow.USER32 ref: 00007FF682E8253B
Part of subcall function 00007FF682E823F0: MoveWindow.USER32 ref: 00007FF682E8258E

Strings

EDIT, xrefs: 00007FF682E8210B
STATIC, xrefs: 00007FF682E8205C, 00007FF682E820B1
BUTTON, xrefs: 00007FF682E82176
Close, xrefs: 00007FF682E82168
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF682E81F7D

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction ID: 40af1d7520037f6ee9a0f4c2be63c5cb9e73006d1a5484036411b5d7181fec49
Opcode Fuzzy Hash: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction Fuzzy Hash: 4CA17A76208B85C6E7148F51E45879AB770FB98B88F50412EDB9E43B24DFBDE164CB00

Function 00007FF682EA471C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF682EA476A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA4DD6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA4F4C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA520A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA542A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA5667
memcpy_s.LIBCPMT ref: 00007FF682EA5742
memcpy_s.LIBCPMT ref: 00007FF682EA57ED
memcpy_s.LIBCPMT ref: 00007FF682EA58BC

Strings

1#SNAN, xrefs: 00007FF682EA487A
1#INF, xrefs: 00007FF682EA4893
1#QNAN, xrefs: 00007FF682EA4883
1#IND, xrefs: 00007FF682EA4857

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 462ebf29a53f9f8e0898a565754c8078d18c0a01f6b8af8c35fed8b76f3e05ac
Instruction ID: f94ff9f317d3c9088d9e164962d998b6b915034267a33e4225a77738b0b677a1
Opcode Fuzzy Hash: 462ebf29a53f9f8e0898a565754c8078d18c0a01f6b8af8c35fed8b76f3e05ac
Instruction Fuzzy Hash: D3B2A272E18296CAE7648E64D5487F926B2FF6434CF50513DDA0EA7E84DFB8A900CB44

Function 00007FF682E88560 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF682E82A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF682E8101D), ref: 00007FF682E88587
FormatMessageW.KERNEL32 ref: 00007FF682E885B6
WideCharToMultiByte.KERNEL32 ref: 00007FF682E8860C

Part of subcall function 00007FF682E829E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF682E887F2,?,?,?,?,?,?,?,?,?,?,?,00007FF682E8101D), ref: 00007FF682E82A14
Part of subcall function 00007FF682E829E0: MessageBoxW.USER32 ref: 00007FF682E82AF0

Strings

WideCharToMultiByte, xrefs: 00007FF682E8861D
PyInstaller: FormatMessageW failed., xrefs: 00007FF682E885D3
Failed to encode wchar_t as UTF-8., xrefs: 00007FF682E88616
No error messages generated., xrefs: 00007FF682E885C0
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF682E88629
FormatMessageW, xrefs: 00007FF682E885C7

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
Instruction ID: b10633b98d409832cb90f9a6d7db48b0f4103e4f7e43bd0303c0b676829b1686
Opcode Fuzzy Hash: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
Instruction Fuzzy Hash: 39214171A08A46C1E720DB11E8582A663B5FFA838CF84013DEA8ED26A5DFBCD145C708

Function 00007FF682E8C57C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF682E8C598
RtlCaptureContext.KERNEL32 ref: 00007FF682E8C5C5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF682E8C5DF
RtlVirtualUnwind.KERNEL32 ref: 00007FF682E8C620
IsDebuggerPresent.KERNEL32 ref: 00007FF682E8C674
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF682E8C695
UnhandledExceptionFilter.KERNEL32 ref: 00007FF682E8C6A0

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
Instruction ID: 5b4d4ee69e8ceff3104969cac501353fad69ab5588e5aebca24fa9a34226f50c
Opcode Fuzzy Hash: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
Instruction Fuzzy Hash: C1316E72608A81CAEB648F60E8443ED3374FFA5748F44403EDA8E97A94DF78D248C718

Function 00007FF682E9ABD8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF682E9AC51
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF682E9AC69
RtlVirtualUnwind.KERNEL32 ref: 00007FF682E9ACA4
IsDebuggerPresent.KERNEL32 ref: 00007FF682E9ACDD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF682E9ACE7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF682E9ACF2

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
Instruction ID: c098212c195818d07e3c528d80c08f96f01c10bfca2abc49a85de152c873109a
Opcode Fuzzy Hash: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
Instruction Fuzzy Hash: 8B316F72618B81C6DB60CF25E8442AE73A4FF99758F50013EEA8D83B98DF78D555CB04

Function 00007FF682EA1EE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA1F30
FindFirstFileExW.KERNEL32 ref: 00007FF682EA203A

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
Instruction ID: cdbc335a85994eb5f02ddab8e6f58afb422ae810eb2afdbae84c6d886f1062b1
Opcode Fuzzy Hash: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
Instruction Fuzzy Hash: CFB1C862B18692C1EB609B2294085B963A1FF64BD8F44413EEE5FA7BC5DFBCE441C314

Function 00007FF682E8C460 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF682E8C48C
GetCurrentThreadId.KERNEL32 ref: 00007FF682E8C49A
GetCurrentProcessId.KERNEL32 ref: 00007FF682E8C4A6
QueryPerformanceCounter.KERNEL32 ref: 00007FF682E8C4B6

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
Instruction ID: eb8f663535aa95dc742d0ef0e35bee48365e6479cb3bbb964ae605ecf307b49d
Opcode Fuzzy Hash: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
Instruction Fuzzy Hash: D2114F62B14F05C9EB008B60E8482B933A4FB29758F441E39EE6D967A4DFB8D194C390

Function 00007FF682EA4280 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF682EA42E6
memcpy_s.LIBCPMT ref: 00007FF682EA4311

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 43f9360f66843736bc9cada0c215731166bd15a538505beae40c5de68a673660
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: A1C1E472B19686C7D724CF19A04866AB7A1FBA4B88F45813CDB4B97B44DF7DE801CB04

Function 00007FF682EA9FF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF682EAA247
RaiseException.KERNEL32 ref: 00007FF682EAA258

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: b4cdb5d9b405a5f2b155a4653528c407a9956d0b6218a393af626003cf1b5a24
Instruction ID: 3d001c4ac880603ce8ce3a9e3697209111d795a645d6ee4c14fed913289f513f
Opcode Fuzzy Hash: b4cdb5d9b405a5f2b155a4653528c407a9956d0b6218a393af626003cf1b5a24
Instruction Fuzzy Hash: 50B13A73604B85CBE765CF29C88A3683BB0FB54B88F148929DA5E837A4CF7AD451C714

Function 00007FF682E888D0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF682E88901
FindClose.KERNEL32 ref: 00007FF682E88910

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
Instruction ID: 1a5e67208c9947625c360b8252dc2f4b8b156c2d7bb7cb9fa2a1588776c0d8f7
Opcode Fuzzy Hash: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
Instruction Fuzzy Hash: 57F08162A1C685C6E760CF64A45C76A73A0FF54728F44033DDAAD866E4DF7CD008CA04

Function 00007FF682E93AE4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF682E93E94
, xrefs: 00007FF682E93C52

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 631a3e48eb673e1850d57232dc56befdf755ff5fd67b38a64b6ca9c49a913018
Instruction ID: fdd84c819e4c8b4c018ce39a9acba0314d7346d3c71478d428eb9b7f3be16b55
Opcode Fuzzy Hash: 631a3e48eb673e1850d57232dc56befdf755ff5fd67b38a64b6ca9c49a913018
Instruction Fuzzy Hash: ACE1A532A18A46C6EB689A39815817D33A0FF45B4CF14523FDA0E87794DF79E861C708

Function 00007FF682E9E4B0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF682E9E63A
e+000, xrefs: 00007FF682E9E5BD

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 95f5c728ca916dfdd01defb08dd518f9d9b28e517fc4b7b4370436378f7798ef
Instruction ID: 4a6ae0a33e7921b1b19607358116864f582171b916fbca0cce85ae2ecec97569
Opcode Fuzzy Hash: 95f5c728ca916dfdd01defb08dd518f9d9b28e517fc4b7b4370436378f7798ef
Instruction Fuzzy Hash: 7A517D62B182C5C6E7248E3599087696791FB44B58F8C823FCB9887AC6DEBDD460C704

Function 00007FF682EA0F38 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 4b7c577155937df3467bd9cdd4550942c9176b8fc8785c5dc3f7c97a7b0e1b3f
Instruction ID: f44c3ddb51a2150ca91d78df773dc1154e12eb474b5fbb7d679d7640d443a8b7
Opcode Fuzzy Hash: 4b7c577155937df3467bd9cdd4550942c9176b8fc8785c5dc3f7c97a7b0e1b3f
Instruction Fuzzy Hash: 7602AF22A1D653C0FB64AB22D40827926E4BF61B98F45453DDD6FEA3D2DEBCE411C308

Function 00007FF682E9E01C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF682E9E35E

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
Instruction ID: c524c740a9a85e3812302d76c9f089cfd883bb6a8b92886cf646527d8311aa9f
Opcode Fuzzy Hash: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
Instruction Fuzzy Hash: 2BA14663A08785C6EB25CB26A4047AD7B91BF50B88F48813BDF8D87781DE7DE521C701

Function 00007FF682E986D0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF682E986EF

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 67c65d79a34d6aec5643e5b3f73a1241e03d40d371e40f538c07cd5aef059625
Instruction ID: b5ac28b1eed0089ee3e4e137037008beff9ec741832bdae84d23c42a8f1ece59
Opcode Fuzzy Hash: 67c65d79a34d6aec5643e5b3f73a1241e03d40d371e40f538c07cd5aef059625
Instruction Fuzzy Hash: 09519015F08352C1FA68EB2759191BA52917F44BCCF48403EDD0ED7BA6EEBCE462C208

Function 00007FF682EA3AF0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF682EA3AF4

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
Instruction ID: 03f89c0fb49ca90a657acfcd10af2691d41d89c193e0e6758aafe42775905cca
Opcode Fuzzy Hash: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
Instruction Fuzzy Hash: C5B09260E1BA46C2EB482B916C8A21422A47F68B04F94403CC10D92320DE6C20B58724

Function 00007FF682E936E0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208e6a978d65b3df04c2d2163cfe11b9ca3e791e60348233d6b397c6ac133608
Instruction ID: ab202a387f5136893c35614b8460dfb0b2d7a88441dd023f1835aa669d4fb979
Opcode Fuzzy Hash: 208e6a978d65b3df04c2d2163cfe11b9ca3e791e60348233d6b397c6ac133608
Instruction Fuzzy Hash: 9CD1A062A08642C6EB788B39845827E27A1FF05B4CF14523ECE0D877D5CFB9E865C348

Function 00007FF682E88FD0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926518188b614a96dab23eca74cd6fab0ac352dd7b9dabb22d14e7e66e5c8c54
Instruction ID: c701cff16b8da0e5197e08692305bacd559af00f17355d37c0820a7118dc583d
Opcode Fuzzy Hash: 926518188b614a96dab23eca74cd6fab0ac352dd7b9dabb22d14e7e66e5c8c54
Instruction Fuzzy Hash: 40C103322142F48BD699EB29E45947A33E2FBA930DBD5403EEB874B785CA3CE414D750

Function 00007FF682E92D50 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67fe5c4df14f10fbabbc179396d5558260dc0a4d214c0f6109c6307dd6f74d9
Instruction ID: ddd6c1267aad89b20d3991d2e3af4a6d21f44c19d34121559918d4a89220585a
Opcode Fuzzy Hash: b67fe5c4df14f10fbabbc179396d5558260dc0a4d214c0f6109c6307dd6f74d9
Instruction Fuzzy Hash: 31B13972908645C5EB658F39809823C7BA4FB49B4CF24423FCA4E87395CFBAD461C749

Function 00007FF682E9EB30 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41de09fd609196546d8b05baa0994189bc53ea50dddfb86cdccda31fca7eba1c
Instruction ID: 56c2d841c461245e7b09671c0ddc164f803e042960a7ae2c1c6562f0f9954bdc
Opcode Fuzzy Hash: 41de09fd609196546d8b05baa0994189bc53ea50dddfb86cdccda31fca7eba1c
Instruction Fuzzy Hash: C081D472A08781C6E7748B2994883B96691FF46798F98423FDB8D83B85DE7DD460CB04

Function 00007FF682EA6D70 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 14e965909f7280d7a3652a0ca181d92c694a9cf8fd4ee26df7ecbe6e2bc61af1
Instruction ID: e0c69dcec4f0f2b8de84e705105fd298794ca14821b2d831241344c50531bd64
Opcode Fuzzy Hash: 14e965909f7280d7a3652a0ca181d92c694a9cf8fd4ee26df7ecbe6e2bc61af1
Instruction Fuzzy Hash: 85611C22F18242C6FF648E29C05823966A1BF62768F14423DD62FD66D5DEFDE901C704

Function 00007FF682E922A4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction ID: 93e8976b4e621bf49d0bd30241e9e260d55883d3909db56981c6f0f30a8da907
Opcode Fuzzy Hash: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction Fuzzy Hash: 81515076A18652C2EB24CB29D04822877A0FF55B6CF24513FCE4D97794CF7AE862C744

Function 00007FF682E91A84 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction ID: 195b585b74b83d96bba100e325e712e27e0a5afe21327c79f1404117b062c583
Opcode Fuzzy Hash: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction Fuzzy Hash: 7E518376A18651C6E7248B29C05826C33A1FF45B6CF24413ECE4D9B794EFBAE862C744

Function 00007FF682E91E94 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction ID: 61e423376866b644d1c2f49c29c6a7eb15555284e4f416e2eabdb80aea06953a
Opcode Fuzzy Hash: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction Fuzzy Hash: 65516036A18655C6EB248B29C04833963A0FF59B5CF24413FDE4D8B794CFBAE862C744

Function 00007FF682E91C90 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction ID: 58b78e290512253a4b2d184c6609e1980176573774e49d239792da8b1151068c
Opcode Fuzzy Hash: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction Fuzzy Hash: 41517176A18651C6E7248B29C04837837A1FF49B5DF64413ECE4C9B794CFBAE862C744

Function 00007FF682E920A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction ID: 9aa27d758951c12717adf0293e943ee8d7427c156393bc2fd236e233bbc12529
Opcode Fuzzy Hash: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction Fuzzy Hash: 83518036A18651C5EB248B29D04822867A1FF45B5CF24413FCE4C97795CFBAEC62CB44

Function 00007FF682E91880 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction ID: 8ddc9e7f4b6066442a8259874503c7d0ed8ca99d80fb19aa3573d40b4c4cf6ca
Opcode Fuzzy Hash: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction Fuzzy Hash: 18515036A18691C5EB248B29C04822867A1FF49B5CF24413ECE4D9B794CFBAED62D744

Function 00007FF682E95F30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 3877a0fe2bd4da318b0f380a682cabd2012f0ee3c5071e57ca130c75585b0a46
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 9E41E25280DB4EC4E9A18D19451C7B42680FF22BB8D5852BFDD9D973C2CE4E25AAC208

Function 00007FF682E9A430 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2970ddd5f501fe71afef01217e103934546d8fb7f20af68bec1b913dc8647c23
Instruction ID: 7f0b8ef807142000a0d8055b02403a1415524c7e75b9034338723bfee0f180ec
Opcode Fuzzy Hash: 2970ddd5f501fe71afef01217e103934546d8fb7f20af68bec1b913dc8647c23
Instruction Fuzzy Hash: B441E162B18A5482EF18CF2AD91816963A1BF48FD8B48903BEE0DD7B58DE7CD452C304

Function 00007FF682E97C98 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
Instruction ID: 713d018354c7bf757c157e7f507389a2ee5b9df03398f7853e474600e549c30c
Opcode Fuzzy Hash: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
Instruction Fuzzy Hash: BD31B672709B4282E764DB25A48427D6AD5BF86B94F04423DEE4EA3BD6DF7CD012C708

Function 00007FF682EA9E40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dada551c461b21fdad657b6bac4cbdfad31b05eb9b59333086b2e0a15b162055
Instruction ID: e654fd2140f44e0877342d04d04dcd4c66904bd8243e32840d0a14ec600ca19c
Opcode Fuzzy Hash: dada551c461b21fdad657b6bac4cbdfad31b05eb9b59333086b2e0a15b162055
Instruction Fuzzy Hash: 59F04471628255CADB948F6DA4426297BD0FB48389B50C07DE599C7E14DA7C9050CF08

Function 00007FF682E8C760 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5749315d7b24dceccc8714b5042f108a7de79c1631c17c6a95dc8ed6b888950b
Instruction ID: 25aa4f11a8de5b454429b2747d5575ef46c9d7681eefed83179b755bc7ca5969
Opcode Fuzzy Hash: 5749315d7b24dceccc8714b5042f108a7de79c1631c17c6a95dc8ed6b888950b
Instruction Fuzzy Hash: 02A0026194CC06D0E7488B20F8580702730FF72308B50103DD44ED10A0DFBDA581C318

Function 00007FF682E86EF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF682E86F07
GetProcAddress.KERNEL32 ref: 00007FF682E86F46
GetProcAddress.KERNEL32 ref: 00007FF682E86F6B
GetProcAddress.KERNEL32 ref: 00007FF682E86F90
GetProcAddress.KERNEL32 ref: 00007FF682E86FB8
GetProcAddress.KERNEL32 ref: 00007FF682E86FE0
GetProcAddress.KERNEL32 ref: 00007FF682E87008
GetProcAddress.KERNEL32 ref: 00007FF682E87030
GetProcAddress.KERNEL32 ref: 00007FF682E87058

Strings

Tcl_Finalize, xrefs: 00007FF682E86FAE
Tcl_GetCurrentThread, xrefs: 00007FF682E8704E
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF682E8706A
Tcl_CreateInterp, xrefs: 00007FF682E86F3C
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF682E872C2
Tcl_ThreadAlert, xrefs: 00007FF682E87166
Tcl_NewByteArrayObj, xrefs: 00007FF682E87256
Failed to get address for Tcl_GetString, xrefs: 00007FF682E87222
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF682E86F58
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF682E86F7D
GetProcAddress, xrefs: 00007FF682E86F20
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF682E8733A
Failed to get address for Tcl_Finalize, xrefs: 00007FF682E86FCA
Failed to get address for Tk_Init, xrefs: 00007FF682E873B2
Tcl_ThreadQueueEvent, xrefs: 00007FF682E8713E
Tcl_EvalObjv, xrefs: 00007FF682E8731E
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF682E870BA
Failed to get address for Tcl_EvalEx, xrefs: 00007FF682E87312
Tk_Init, xrefs: 00007FF682E87396
Tcl_NewStringObj, xrefs: 00007FF682E8722E
Tcl_ConditionNotify, xrefs: 00007FF682E870EE
Failed to get address for Tcl_Alloc, xrefs: 00007FF682E87362
Tcl_GetObjResult, xrefs: 00007FF682E872A6
Failed to get address for Tcl_CreateThread, xrefs: 00007FF682E87042
Tcl_CreateObjCommand, xrefs: 00007FF682E871DE
Tcl_DoOneEvent, xrefs: 00007FF682E86F86
Tcl_MutexLock, xrefs: 00007FF682E87076
Tcl_Free, xrefs: 00007FF682E8736E
Tk_GetNumMainWindows, xrefs: 00007FF682E873BE
Tcl_FindExecutable, xrefs: 00007FF682E86F61
Tcl_ConditionWait, xrefs: 00007FF682E87116
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF682E871FA
Tcl_GetVar2, xrefs: 00007FF682E8718E
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF682E8724A
Tcl_FinalizeThread, xrefs: 00007FF682E86FD6
Failed to get address for Tcl_SetVar2, xrefs: 00007FF682E871D2
Tcl_DeleteInterp, xrefs: 00007FF682E86FFE
Failed to get address for Tcl_Init, xrefs: 00007FF682E86F19
Tcl_SetVar2Ex, xrefs: 00007FF682E8727E
Failed to get address for Tcl_GetVar2, xrefs: 00007FF682E871AA
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF682E87272
Tcl_MutexUnlock, xrefs: 00007FF682E8709E
Tcl_EvalEx, xrefs: 00007FF682E872F6
Tcl_ConditionFinalize, xrefs: 00007FF682E870C6
Tcl_Alloc, xrefs: 00007FF682E87346
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF682E87182
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF682E86FF2
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF682E8715A
Failed to get address for Tcl_Free, xrefs: 00007FF682E8738A
Tcl_CreateThread, xrefs: 00007FF682E87026
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF682E8701A
Tcl_Init, xrefs: 00007FF682E86F00
Tcl_EvalFile, xrefs: 00007FF682E872CE
Failed to get address for Tcl_MutexLock, xrefs: 00007FF682E87092
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF682E8729A
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF682E8710A
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF682E87132
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF682E873DA
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF682E86FA2
Tcl_GetString, xrefs: 00007FF682E87206
Tcl_SetVar2, xrefs: 00007FF682E871B6
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF682E870E2
Failed to get address for Tcl_EvalFile, xrefs: 00007FF682E872EA

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
Instruction ID: 7ec6f2d999aea7c84984b85bc5b2e5a6e0825320c672ba0dea9bea463020b7d2
Opcode Fuzzy Hash: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
Instruction Fuzzy Hash: 7EE1B364A49B03D0FB598F05A8981B467B5BF25758F84503DD89FA63A4EFFCF548C208

Function 00007FF682E812B0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF682E82B30: MessageBoxW.USER32 ref: 00007FF682E82C05

_fread_nolock.LIBCMT ref: 00007FF682E81499

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF682E8132B
Failed to extract %s: failed to open archive file!, xrefs: 00007FF682E812FE
%s%c%s, xrefs: 00007FF682E813EE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF682E81370
fseek, xrefs: 00007FF682E81332
fread, xrefs: 00007FF682E814C6
malloc, xrefs: 00007FF682E81377
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF682E814BF
\, xrefs: 00007FF682E813F5

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: 177abdf14fc9c841984a4527118494491755f9154b3595ae679b628ca0bad231
Instruction ID: 58e46f8aa075a45b4878bc7c7a1cb6d82b19674b21597cbf53e55b6ea53bbe4e
Opcode Fuzzy Hash: 177abdf14fc9c841984a4527118494491755f9154b3595ae679b628ca0bad231
Instruction Fuzzy Hash: 7B51C561A58683C5EA209711E8587FA23A0FF5478CF80403EEE8DD7B95DEBCE541C708

Function 00007FF682E823F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF682E8241B
SelectObject.GDI32 ref: 00007FF682E82462
DrawTextW.USER32 ref: 00007FF682E82485
SelectObject.GDI32 ref: 00007FF682E8249B
ReleaseDC.USER32 ref: 00007FF682E824AB
MoveWindow.USER32 ref: 00007FF682E824FB
MoveWindow.USER32 ref: 00007FF682E8253B
MoveWindow.USER32 ref: 00007FF682E8258E
MoveWindow.USER32 ref: 00007FF682E825D6

Strings

P%, xrefs: 00007FF682E8246F

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction ID: 2aef13ee5708f4007a964cd6f0c3f1fd5307f958b4c54f76f9ac2b5dd0645cbd
Opcode Fuzzy Hash: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction Fuzzy Hash: B4510666614BA1C6D7249F22A01C1BAB7A1FBA8B65F004129EBCF83684DF7CD085CB14

Function 00007FF682E967A4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E967E7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E96BD4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E96E70

Strings

p, xrefs: 00007FF682E96899
:, xrefs: 00007FF682E969A0
p, xrefs: 00007FF682E96911
f, xrefs: 00007FF682E96909
-, xrefs: 00007FF682E9687D

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
Instruction ID: b23eb27b5e28d1cd0d535fbc22d663079262002749f121b36751b85ee41e3e0b
Opcode Fuzzy Hash: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
Instruction Fuzzy Hash: B7126272E08143C6FB24AE15D1586B976A1FF40758F94803FE699876C4EFBCE5A4CB08

Function 00007FF682E91108 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E91148
_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E91510
_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E917AF

Strings

f, xrefs: 00007FF682E91395
p, xrefs: 00007FF682E91252
f, xrefs: 00007FF682E9124A
f, xrefs: 00007FF682E911E0
p, xrefs: 00007FF682E911ED

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction ID: 3b448b94775dd284ed3e00c49c893772784694044053a1d22bd070329e23ee85
Opcode Fuzzy Hash: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction Fuzzy Hash: 06128162E0C243C6FB609A55E0487B97261FF41758F84413FE69A8A7C4DFBDE4A0DB18

Function 00007FF682E815A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF682E81609
Failed to extract %s: failed to open archive file!, xrefs: 00007FF682E815D3
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF682E81639
fseek, xrefs: 00007FF682E81610
fread, xrefs: 00007FF682E816C9
malloc, xrefs: 00007FF682E81640
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF682E816C2

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 50ef22e55c6d384a611bdd27779cbc563cb6f2ecfb2fcee110ada23eaf159ce0
Instruction ID: f4ac239d0bd2433808a40ed7000d75432dec76ba56abd353699a300829cad54a
Opcode Fuzzy Hash: 50ef22e55c6d384a611bdd27779cbc563cb6f2ecfb2fcee110ada23eaf159ce0
Instruction Fuzzy Hash: C231A261B58683C6EA209B51E4081BA63A0FF147CCF58403EDE8E9BA55EEBCE541D708

Function 00007FF682E8EB00 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF682E8EB5D

Part of subcall function 00007FF682E8FA70: __GetUnwindTryBlock.LIBCMT ref: 00007FF682E8FAB3
Part of subcall function 00007FF682E8FA70: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF682E8FAD8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF682E8EC35
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF682E8EE8A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF682E8EF96

Strings

csm, xrefs: 00007FF682E8EB77
csm, xrefs: 00007FF682E8EC58
csm, xrefs: 00007FF682E8EBDE

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
Instruction ID: e6ec9abcb091619b00ca26b3a17911cb4e8c706e109b5a978c7f3efbc75245e7
Opcode Fuzzy Hash: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
Instruction Fuzzy Hash: FFE18B32A48B81CAEB209B65D4482AD77A0FF45B9CF58013DEE8D97B95DF78E480C704

Function 00007FF682E9F1D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF682E9F56A,?,?,00000231371D9A68,00007FF682E9B317,?,?,?,00007FF682E9B20E,?,?,?,00007FF682E96452), ref: 00007FF682E9F34C
GetProcAddress.KERNEL32(?,?,?,00007FF682E9F56A,?,?,00000231371D9A68,00007FF682E9B317,?,?,?,00007FF682E9B20E,?,?,?,00007FF682E96452), ref: 00007FF682E9F358

Strings

ext-ms-, xrefs: 00007FF682E9F2A9
api-ms-, xrefs: 00007FF682E9F296

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
Instruction ID: 757b8b00091504724aa287dfe50c0d0d855c43d15462012dc62837a21655d322
Opcode Fuzzy Hash: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
Instruction Fuzzy Hash: 3C411161B19A02C1FB16CB16A8082753391BF45BA8F98453EDD0DD77C4EEBCE459C348

Function 00007FF682E886B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF682E8101D), ref: 00007FF682E88747
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF682E8101D), ref: 00007FF682E8879E

Strings

Out of memory., xrefs: 00007FF682E887CF
WideCharToMultiByte, xrefs: 00007FF682E887E6
Failed to encode wchar_t as UTF-8., xrefs: 00007FF682E887C6
win32_utils_to_utf8, xrefs: 00007FF682E887D6
Failed to get UTF-8 buffer size., xrefs: 00007FF682E887DF

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: eab7300bdb6d3a0e8c37a52e8ffe4b868ba89da5f1b431e459bc38a6420b0676
Instruction ID: e2f20b88df25c4faae4f65825bd46e971b9684ce246b9918d7ed34dcb2215faf
Opcode Fuzzy Hash: eab7300bdb6d3a0e8c37a52e8ffe4b868ba89da5f1b431e459bc38a6420b0676
Instruction Fuzzy Hash: 7D418C32A08A86C2E620CF15A84416AA6A1FF95B98F54413DEE8DC7B94DFBCD051C708

Function 00007FF682E88BF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF682E839EA), ref: 00007FF682E88C31

Part of subcall function 00007FF682E829E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF682E887F2,?,?,?,?,?,?,?,?,?,?,?,00007FF682E8101D), ref: 00007FF682E82A14
Part of subcall function 00007FF682E829E0: MessageBoxW.USER32 ref: 00007FF682E82AF0

WideCharToMultiByte.KERNEL32(?,00007FF682E839EA), ref: 00007FF682E88CA5

Strings

Out of memory., xrefs: 00007FF682E88C6B
WideCharToMultiByte, xrefs: 00007FF682E88C45, 00007FF682E88CB6
Failed to encode wchar_t as UTF-8., xrefs: 00007FF682E88CAF
win32_utils_to_utf8, xrefs: 00007FF682E88C72
Failed to get UTF-8 buffer size., xrefs: 00007FF682E88C3E

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 2e1636658b28b01bd5fed9df7358174580d9369d5f4c6a29190667afae102fd2
Instruction ID: 9be042ccffa08925bc25e9f4671b608a6862fa0ee803cf2eab949824628cc992
Opcode Fuzzy Hash: 2e1636658b28b01bd5fed9df7358174580d9369d5f4c6a29190667afae102fd2
Instruction Fuzzy Hash: 81218531609B46C5E710DF16A8480797661FF95B88B58413DDA8ED3794DFBCE541C308

Function 00007FF682E875A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF682E87716

Part of subcall function 00007FF682E90250: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682E90264

Part of subcall function 00007FF682E90224: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682E90238

Strings

PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF682E87632
%s%c%s, xrefs: 00007FF682E875E5
WARNING: file already exists but should not: %s, xrefs: 00007FF682E87698
\, xrefs: 00007FF682E875EC
ERROR: file already exists but should not: %s, xrefs: 00007FF682E8767C

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: 0c183e133c5fbc1ffe3f319d699f8627423da4d6d465f0011bb75cd22a0eadb8
Instruction ID: ff4052228131bcaf76cbe246d5130eefdb4d41d256ec14ba0c439c15a30bc227
Opcode Fuzzy Hash: 0c183e133c5fbc1ffe3f319d699f8627423da4d6d465f0011bb75cd22a0eadb8
Instruction Fuzzy Hash: 75519224A4D643D1FA109725D99C2F952917F95B88F88003DED8DC77D6EEECE500C348

Function 00007FF682E87420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF682E88AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF682E82ABB), ref: 00007FF682E88B1A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF682E879A1,00000000,?,00000000,00000000,?,00007FF682E8154F), ref: 00007FF682E8747F

Part of subcall function 00007FF682E82B30: MessageBoxW.USER32 ref: 00007FF682E82C05

Strings

LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF682E87456
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF682E874DA
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF682E87493

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
Instruction ID: 2f4e7860266e6245bc1c66aa70d42cf987e2b7b6d61590983902a88a7255dbbb
Opcode Fuzzy Hash: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
Instruction Fuzzy Hash: 3F318955F5D782D0FB209721D59D3BA5291BF987C8F44443EDA8EC2BD6EEACE104C608

Function 00007FF682E8DDB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF682E8E06A,?,?,?,00007FF682E8DD5C,?,?,00000001,00007FF682E8D979), ref: 00007FF682E8DE3D
GetLastError.KERNEL32(?,?,?,00007FF682E8E06A,?,?,?,00007FF682E8DD5C,?,?,00000001,00007FF682E8D979), ref: 00007FF682E8DE4B
LoadLibraryExW.KERNEL32(?,?,?,00007FF682E8E06A,?,?,?,00007FF682E8DD5C,?,?,00000001,00007FF682E8D979), ref: 00007FF682E8DE75
FreeLibrary.KERNEL32(?,?,?,00007FF682E8E06A,?,?,?,00007FF682E8DD5C,?,?,00000001,00007FF682E8D979), ref: 00007FF682E8DEBB
GetProcAddress.KERNEL32(?,?,?,00007FF682E8E06A,?,?,?,00007FF682E8DD5C,?,?,00000001,00007FF682E8D979), ref: 00007FF682E8DEC7

Strings

api-ms-, xrefs: 00007FF682E8DE5D

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
Instruction ID: f9aab01c52e71de5fd17b5dff0661c54f1821f5409f63ccb3f3c35a3808c1d58
Opcode Fuzzy Hash: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
Instruction Fuzzy Hash: 1F31C522E5AB42D1EE61DB12A80857923D4FF68BA8F59053DDD9E97780DFBCE440C308

Function 00007FF682E88AE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF682E82ABB), ref: 00007FF682E88B1A

Part of subcall function 00007FF682E829E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF682E887F2,?,?,?,?,?,?,?,?,?,?,?,00007FF682E8101D), ref: 00007FF682E82A14
Part of subcall function 00007FF682E829E0: MessageBoxW.USER32 ref: 00007FF682E82AF0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF682E82ABB), ref: 00007FF682E88BA0

Strings

Out of memory., xrefs: 00007FF682E88B62
Failed to decode wchar_t from UTF-8, xrefs: 00007FF682E88BAA
Failed to get wchar_t buffer size., xrefs: 00007FF682E88B27
win32_utils_from_utf8, xrefs: 00007FF682E88B69
MultiByteToWideChar, xrefs: 00007FF682E88B2E, 00007FF682E88BB1

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: e9f73450c241f9258fe7f7d1ce7d786b1826e77a4ef85916bb6afda639b6a0a1
Instruction ID: 0c024d66c9f50892070b2816f775577f9850d7531ca67a7e93c7e56f20bee802
Opcode Fuzzy Hash: e9f73450c241f9258fe7f7d1ce7d786b1826e77a4ef85916bb6afda639b6a0a1
Instruction Fuzzy Hash: 22217366B08A42C1EB50CB15F804169A3A1FF957C8F58423DDB8DD3BA9EF6CD541C708

Function 00007FF682E9B710 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF682E9B71F
FlsGetValue.KERNEL32 ref: 00007FF682E9B734
FlsSetValue.KERNEL32 ref: 00007FF682E9B755
FlsSetValue.KERNEL32 ref: 00007FF682E9B782
FlsSetValue.KERNEL32 ref: 00007FF682E9B793
FlsSetValue.KERNEL32 ref: 00007FF682E9B7A4
SetLastError.KERNEL32 ref: 00007FF682E9B7BF

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5e25a57dc3899cb5d9e1114fbc8c557aa55031a2469902f6cab5e8a78f8e35b9
Instruction ID: 220a3be72eba34e4fa41b67c24b4b90bd802b194b94ef3eb7cfa581c3fbf69a1
Opcode Fuzzy Hash: 5e25a57dc3899cb5d9e1114fbc8c557aa55031a2469902f6cab5e8a78f8e35b9
Instruction Fuzzy Hash: 77218E64A0C342C1FA68A771565D17A62527F447B8F54073EE83ED6BC7DEECA821C608

Function 00007FF682EA85BC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF682EA85ED
GetLastError.KERNEL32 ref: 00007FF682EA85F9
CloseHandle.KERNEL32 ref: 00007FF682EA8611
CreateFileW.KERNEL32 ref: 00007FF682EA863C
WriteConsoleW.KERNEL32 ref: 00007FF682EA865B

Strings

CONOUT$, xrefs: 00007FF682EA861D

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
Instruction ID: f98378314f74437ed29084499fd3454eb112e308333751e61a5a31ce727514ca
Opcode Fuzzy Hash: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
Instruction Fuzzy Hash: 29118161A18B41C6F7508B46E85832966B0FFA8BE8F44023CDA5ED77A4CFBCD444C748

Function 00007FF682E9B888 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF682E954CD,?,?,?,?,00007FF682E9F1BF,?,?,00000000,00007FF682E9B9A6,?,?,?), ref: 00007FF682E9B897
FlsSetValue.KERNEL32(?,?,?,00007FF682E954CD,?,?,?,?,00007FF682E9F1BF,?,?,00000000,00007FF682E9B9A6,?,?,?), ref: 00007FF682E9B8CD
FlsSetValue.KERNEL32(?,?,?,00007FF682E954CD,?,?,?,?,00007FF682E9F1BF,?,?,00000000,00007FF682E9B9A6,?,?,?), ref: 00007FF682E9B8FA
FlsSetValue.KERNEL32(?,?,?,00007FF682E954CD,?,?,?,?,00007FF682E9F1BF,?,?,00000000,00007FF682E9B9A6,?,?,?), ref: 00007FF682E9B90B
FlsSetValue.KERNEL32(?,?,?,00007FF682E954CD,?,?,?,?,00007FF682E9F1BF,?,?,00000000,00007FF682E9B9A6,?,?,?), ref: 00007FF682E9B91C
SetLastError.KERNEL32(?,?,?,00007FF682E954CD,?,?,?,?,00007FF682E9F1BF,?,?,00000000,00007FF682E9B9A6,?,?,?), ref: 00007FF682E9B937

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 941158fb4e6d3a9375e13d6d10033e8ffcdbbced4d4dd5e625aa307a16b34608
Instruction ID: 2ec04fc622f0de3efa8ad2994205c21b5ce4b18cf417155aed6fe73ace899a80
Opcode Fuzzy Hash: 941158fb4e6d3a9375e13d6d10033e8ffcdbbced4d4dd5e625aa307a16b34608
Instruction Fuzzy Hash: 781181A0E0C742C5F7289771554D17922517F487B8F54073ED83ED67C6DEACA421C708

Function 00007FF682E8D778 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF682E8D7A3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF682E8D838
RtlUnwindEx.KERNEL32 ref: 00007FF682E8D887

Strings

f, xrefs: 00007FF682E8D7B6
csm, xrefs: 00007FF682E8D81E

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
Instruction ID: 7fddbde1559668f4762a270dbc047662b4ac2f0a6931c50a0092c494aae39b16
Opcode Fuzzy Hash: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
Instruction Fuzzy Hash: EC51A332A59642CADB15DB25E408A293795FF40B9CF51813CDADE87B48DFF8E941C708

Function 00007FF682E82600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF682E827EF), ref: 00007FF682E82638
DialogBoxIndirectParamW.USER32 ref: 00007FF682E826FC
DeleteObject.GDI32 ref: 00007FF682E8272F
DestroyIcon.USER32 ref: 00007FF682E82741

Strings

Unhandled exception in script, xrefs: 00007FF682E82668

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
Instruction ID: cd4ffd9716e4e86e65e28853f788ff3beb80f7429db6fc6a9a01da43fbc77b9f
Opcode Fuzzy Hash: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
Instruction Fuzzy Hash: AB316372A19A82C9EB24DF61E8592F96360FF88788F44413EEA8E87B55DF7CD105C704

Function 00007FF682E829E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF682E887F2,?,?,?,?,?,?,?,?,?,?,?,00007FF682E8101D), ref: 00007FF682E82A14

Part of subcall function 00007FF682E88560: GetLastError.KERNEL32(00000000,00007FF682E82A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF682E8101D), ref: 00007FF682E88587
Part of subcall function 00007FF682E88560: FormatMessageW.KERNEL32 ref: 00007FF682E885B6

Part of subcall function 00007FF682E88AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF682E82ABB), ref: 00007FF682E88B1A

MessageBoxW.USER32 ref: 00007FF682E82AF0
MessageBoxA.USER32 ref: 00007FF682E82B0C

Strings

%s%s: %s, xrefs: 00007FF682E82A6B
Fatal error detected, xrefs: 00007FF682E82AC6, 00007FF682E82AFE

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
Instruction ID: 33094171282ab8b3c829ae2e1e24f0c35db3acba6a2e239622f9a6c2f783e22b
Opcode Fuzzy Hash: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
Instruction Fuzzy Hash: 34319272628A85C1E730DB10E4556DA6364FF94788F40413EEACD97A99DFBCD305CB48

Function 00007FF682E9A018 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF682E9A03D
GetProcAddress.KERNEL32 ref: 00007FF682E9A053
FreeLibrary.KERNEL32 ref: 00007FF682E9A07A

Strings

mscoree.dll, xrefs: 00007FF682E9A034
CorExitProcess, xrefs: 00007FF682E9A04C

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
Instruction ID: 844bb1ccff26ebd21416d1e8cc568504516556ede24d5540dfa98a4ccd9a1eb4
Opcode Fuzzy Hash: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
Instruction Fuzzy Hash: E3F04F61A09702C1EF208B24E84C37A5770FF69769F94023EC56E862E4CFBDD488C358

Function 00007FF682EA9C40 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF682EA9C68
_set_statfp.LIBCMT ref: 00007FF682EA9C83
_set_statfp.LIBCMT ref: 00007FF682EA9C9F
_set_statfp.LIBCMT ref: 00007FF682EA9CDB

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: 775fb1366835ba3ae7fb17160cd89c3e226b005e07263ea1cfea6ed17105d0d0
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: 3C114272E18E03C1F7641568E54E3B918F17F753A8E09463CE56FA67DACEAD6844C20C

Function 00007FF682E9B950 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF682E9AB67,?,?,00000000,00007FF682E9AE02,?,?,?,?,?,00007FF682E930CC), ref: 00007FF682E9B96F
FlsSetValue.KERNEL32(?,?,?,00007FF682E9AB67,?,?,00000000,00007FF682E9AE02,?,?,?,?,?,00007FF682E930CC), ref: 00007FF682E9B98E
FlsSetValue.KERNEL32(?,?,?,00007FF682E9AB67,?,?,00000000,00007FF682E9AE02,?,?,?,?,?,00007FF682E930CC), ref: 00007FF682E9B9B6
FlsSetValue.KERNEL32(?,?,?,00007FF682E9AB67,?,?,00000000,00007FF682E9AE02,?,?,?,?,?,00007FF682E930CC), ref: 00007FF682E9B9C7
FlsSetValue.KERNEL32(?,?,?,00007FF682E9AB67,?,?,00000000,00007FF682E9AE02,?,?,?,?,?,00007FF682E930CC), ref: 00007FF682E9B9D8

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4fc6ccaa14371e387e5c22fb95057e46c3ade10dd54edcd3ce0e48e5b46d1de5
Instruction ID: 76c231f6557d34daa4378b1e57b38da5632e784429cbbedf0ebfbc0d5f311f6a
Opcode Fuzzy Hash: 4fc6ccaa14371e387e5c22fb95057e46c3ade10dd54edcd3ce0e48e5b46d1de5
Instruction Fuzzy Hash: 7311AF60B08242C5FA689B66954927931417F403B8F58433EE87ED67C6DEACE861C608

Function 00007FF682E9B7E4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF682E9B7F5
FlsSetValue.KERNEL32 ref: 00007FF682E9B814
FlsSetValue.KERNEL32 ref: 00007FF682E9B83C
FlsSetValue.KERNEL32 ref: 00007FF682E9B84D
FlsSetValue.KERNEL32 ref: 00007FF682E9B85E

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 64fe73475c7f3c5e3ff0e30dd8e21900901c314ca9004384e47b330d372873f3
Instruction ID: 393235a9fc2fd5125e50924aa87692e5a661693e2a2f34c2c4b56e7af9c92e67
Opcode Fuzzy Hash: 64fe73475c7f3c5e3ff0e30dd8e21900901c314ca9004384e47b330d372873f3
Instruction Fuzzy Hash: A21118A0E09207C6FA78AB71585D1B921817F4977CE58073ED83EDA2D3DDBCB821C619

Function 00007FF682E964B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E964F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E9661A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E966D0

Strings

verbose, xrefs: 00007FF682E964C4

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction ID: b800a10a8ad36378b496da5f61322a9600f67750b57b42b9271545942fc2ac3c
Opcode Fuzzy Hash: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction Fuzzy Hash: 8F91BF32A08646C6E7618F25D45877D36A4BF40B9CF84413FDA9E863D6DEBDE861C308

Function 00007FF682EA05A8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA0887

Part of subcall function 00007FF682EA69C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA69E1

Strings

ccs, xrefs: 00007FF682EA07C2
UTF-16LEUNICODE, xrefs: 00007FF682EA0825
UTF-8, xrefs: 00007FF682EA0806

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
Instruction ID: 1fb315f0a2b896398d3c8796757de083669acf6c9b833588fa36be05cd2613d6
Opcode Fuzzy Hash: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
Instruction Fuzzy Hash: 54819F72D08202C5E7659E29C21837836F0BF61B8CF55803DEA0BE7695DEBDE801DA49

Function 00007FF682E8EFD8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF682E8F024
_CallSETranslator.LIBVCRUNTIME ref: 00007FF682E8F073

Strings

RCC, xrefs: 00007FF682E8F041
MOC, xrefs: 00007FF682E8F038

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
Instruction ID: 82f1baf2c4ee84bb27a4942a8601526b91148da9f39a3919c076ba3e4ed7ac01
Opcode Fuzzy Hash: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
Instruction Fuzzy Hash: 59617932A08A45CAE7208F65D4843BD77A0FB58B8CF444229EE8D97B99DFB8E155C704

Function 00007FF682E8F334 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF682E8F35C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF682E8F444

Strings

csm, xrefs: 00007FF682E8F496
csm, xrefs: 00007FF682E8F37E

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
Instruction ID: c0a9ca5c6a14d1934ff016c3c494b962dca7344afe331f16570c62ad7a042d51
Opcode Fuzzy Hash: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
Instruction Fuzzy Hash: 49517B72948282C6EA748F11954827877A0FF54B98F94413EDADDC7AD5DFBCE850CB08

Function 00007FF682E82890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF682E88AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF682E82ABB), ref: 00007FF682E88B1A

MessageBoxW.USER32 ref: 00007FF682E8299B
MessageBoxA.USER32 ref: 00007FF682E829B7

Strings

%s%s: %s, xrefs: 00007FF682E82916
Fatal error detected, xrefs: 00007FF682E82971, 00007FF682E829A9

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
Instruction ID: 59c0c95499f01e5559a809adddcf1733d7fb6473aa03d23ff210239ec72ab7bf
Opcode Fuzzy Hash: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
Instruction Fuzzy Hash: E2318372628A81C1E630DB10E4556EA6364FF947C8F80413EEACD97A99DFBCD305CB48

Function 00007FF682E83EC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF682E839EA), ref: 00007FF682E83EF1

Part of subcall function 00007FF682E829E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF682E887F2,?,?,?,?,?,?,?,?,?,?,?,00007FF682E8101D), ref: 00007FF682E82A14
Part of subcall function 00007FF682E829E0: MessageBoxW.USER32 ref: 00007FF682E82AF0

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF682E83F2A
GetModuleFileNameW, xrefs: 00007FF682E83F02
Failed to get executable path., xrefs: 00007FF682E83EFB

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
Instruction ID: 452f24192cfeb73a2be44c132cf8a1f634eb1056769de1ff971a51f556739d1c
Opcode Fuzzy Hash: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
Instruction Fuzzy Hash: 10017561B6D646C0FA609721D85E3F553A17F5C78CF80043ED88EC62A2EE9CE105C708

Function 00007FF682E9CB60 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF682E9CBDF
WriteFile.KERNEL32 ref: 00007FF682E9CEA7
WriteFile.KERNEL32 ref: 00007FF682E9CEED
GetLastError.KERNEL32 ref: 00007FF682E9CFA3

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
Instruction ID: 6f65d8fae5b209d9ba443daeea66b7f9e03a54ccf18a97869473decf08bd672b
Opcode Fuzzy Hash: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
Instruction Fuzzy Hash: C7D1FF72B18A81C9E710CF65D4442AC3BB1FB58B9CB04523EDE5EA7B99DE78D416C304

Function 00007FF682E82330 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF682E82364
SetWindowLongPtrW.USER32 ref: 00007FF682E82386
GetWindowLongPtrW.USER32 ref: 00007FF682E823B0
InvalidateRect.USER32 ref: 00007FF682E823D0

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction ID: f432ac824f25ca7a5b76e9d051319c330f336b7ec9b2b97ae95e3c43c1729574
Opcode Fuzzy Hash: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction Fuzzy Hash: 8E110C61E58183C2FB54976AF55C2B912A1FF94B85F44803DEA8947B8DCDFCD4C5C608

Function 00007FF682EA628C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF682EA1DD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA1E03

_get_daylight.LIBCMT ref: 00007FF682EA63A4
_get_daylight.LIBCMT ref: 00007FF682EA63B5

Strings

?, xrefs: 00007FF682EA6335

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
Instruction ID: a05a97147a5e824bfa1b5b50f62dc98a27e6ce4b483d8defb10517a0b84d3e27
Opcode Fuzzy Hash: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
Instruction Fuzzy Hash: DB411712A18282C2FB209B25D40937A56B0FFA1BACF14423DEF6E96AD5DE7CD442C704

Function 00007FF682E995A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682E995D6

Part of subcall function 00007FF682E9AF0C: RtlFreeHeap.NTDLL(?,?,?,00007FF682EA3392,?,?,?,00007FF682EA33CF,?,?,00000000,00007FF682EA3895,?,?,00000000,00007FF682EA37C7), ref: 00007FF682E9AF22
Part of subcall function 00007FF682E9AF0C: GetLastError.KERNEL32(?,?,?,00007FF682EA3392,?,?,?,00007FF682EA33CF,?,?,00000000,00007FF682EA3895,?,?,00000000,00007FF682EA37C7), ref: 00007FF682E9AF2C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF682E8BFE5), ref: 00007FF682E995F4

Strings

C:\Users\user\Desktop\7EznMik8Fw.exe, xrefs: 00007FF682E995E2

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\7EznMik8Fw.exe
API String ID: 3580290477-3256252632
Opcode ID: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
Instruction ID: 170ac1d51c811683a80ed14c7d3e130f49cc6da5503d74b78fdcdd4c098a554e
Opcode Fuzzy Hash: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
Instruction Fuzzy Hash: D0418172A08752C6EB64DF25D4441B93794FF84B88B54403EE94E87B85DF7DE4A1C308

Function 00007FF682E9D1F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF682E9D30F
GetLastError.KERNEL32 ref: 00007FF682E9D331

Strings

U, xrefs: 00007FF682E9D2BB

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
Instruction ID: 58ae286e331e98c654f20b30a78a65dbb14fb4e769634a52b0f6f879c93f92f8
Opcode Fuzzy Hash: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
Instruction Fuzzy Hash: D441D262A18A51C1EB20DF65E4483A967A0FF98B98F80403EEE8DC7798DFBCD451C704

Function 00007FF682E9F918 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF682E9F958
GetCurrentDirectoryW.KERNEL32 ref: 00007FF682E9F9AA

Strings

:, xrefs: 00007FF682E9F96E

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 4482f0b2aa88d097fa4b172b4d0b9d8fa621ceaf6a6e580bcf5a02da10cef38f
Instruction ID: c98ba5eb37b6aacbc78e7966bf7700c03a85d41824dc8bd77950793dfe956a56
Opcode Fuzzy Hash: 4482f0b2aa88d097fa4b172b4d0b9d8fa621ceaf6a6e580bcf5a02da10cef38f
Instruction Fuzzy Hash: 9521E162A08681C5EB209B15D05D26D73B1FF84B4CF95803EDA9D832C4DFBCE955C749

Function 00007FF682E82C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF682E88AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF682E82ABB), ref: 00007FF682E88B1A

MessageBoxW.USER32 ref: 00007FF682E82D25
MessageBoxA.USER32 ref: 00007FF682E82D41

Strings

Error detected, xrefs: 00007FF682E82CFB, 00007FF682E82D33

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
Instruction ID: 2e7072edf530e11c62268c5a8f3f2578b83af53d55d257adf342c532a607f0fc
Opcode Fuzzy Hash: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
Instruction Fuzzy Hash: AD21B772628A85D1EB20D710F4946EA6364FF9478CF80113EE68D97AA5DFBCD205C704

Function 00007FF682E82B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF682E88AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF682E82ABB), ref: 00007FF682E88B1A

MessageBoxW.USER32 ref: 00007FF682E82C05
MessageBoxA.USER32 ref: 00007FF682E82C21

Strings

Fatal error detected, xrefs: 00007FF682E82BDB, 00007FF682E82C13

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
Instruction ID: b31540b1f9e6f8a79bc507550bbe3ec3e73c0a8f1e599e302f2cc162711f8ae2
Opcode Fuzzy Hash: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
Instruction Fuzzy Hash: D821A372628A85C1EB20DB10F4546EA6364FF9478CF80113EEA8D97AA5DFBCD205CB04

Function 00007FF682E8FE80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF682E8FED0
RaiseException.KERNEL32 ref: 00007FF682E8FF11

Strings

csm, xrefs: 00007FF682E8FEFE

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
Instruction ID: f982595eee408fdcdb465e14937998d5d83c4d54744a23e0cf94c391ffe2bf3c
Opcode Fuzzy Hash: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
Instruction Fuzzy Hash: B5113732618B4182EB608B15F45426977A0FB98B98F584239DACD87799EF7CC551CB04

Function 00007FF682EA041C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF682EA044C
GetDriveTypeW.KERNEL32 ref: 00007FF682EA048C

Strings

:, xrefs: 00007FF682EA0475

Memory Dump Source

Source File: 00000000.00000002.3397017480.00007FF682E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF682E80000, based on PE: true

Associated: 00000000.00000002.3396989948.00007FF682E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397049276.00007FF682EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397076452.00007FF682EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3397125800.00007FF682EC2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff682e80000_7EznMik8Fw.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
Instruction ID: 96f8bfc1130e00cf3c76d85ea56d63f0d9fda8a5b5418348fd3b2279374bf588
Opcode Fuzzy Hash: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
Instruction Fuzzy Hash: FE014F6191C246C6FB60AF60D4692BE63A0FF9470DF84003ED54ED6691DFBCE944CA18

Analysis Process: 7EznMik8Fw.exePID: 4196, Parent PID: 4344COMMON

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32%
Total number of Nodes:	362
Total number of Limit Nodes:	40

Executed Functions

Function 00007FFD936318C0 Relevance: 142.0, APIs: 44, Strings: 37, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyModule_Create2.PYTHON3 ref: 00007FFD936318EB
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 00007FFD93631904

Part of subcall function 00007FFD936313D0: PyEval_SaveThread.PYTHON3 ref: 00007FFD936313DA
Part of subcall function 00007FFD936313D0: LoadLibraryA.KERNEL32 ref: 00007FFD936313EA
Part of subcall function 00007FFD936313D0: PyEval_RestoreThread.PYTHON3 ref: 00007FFD936313F6
Part of subcall function 00007FFD936313D0: PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFD9363140A

RtlGetVersion.NTDLL ref: 00007FFD93631945
GetSystemInfo.KERNEL32 ref: 00007FFD936319C1
InitializeCriticalSection.KERNEL32 ref: 00007FFD936319CE
PyModule_GetState.PYTHON3 ref: 00007FFD936319E8
PyErr_NewException.PYTHON3 ref: 00007FFD936319FD
_Py_Dealloc.PYTHON3 ref: 00007FFD93631A1B
PyErr_NewException.PYTHON3 ref: 00007FFD93631A50
PyModule_AddObject.PYTHON3 ref: 00007FFD93631A6D
PyErr_NewException.PYTHON3 ref: 00007FFD93631A7F
PyModule_AddObject.PYTHON3 ref: 00007FFD93631A9C
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631AB2
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631AC8
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631ADE
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631AF4
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631B0A
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631B20
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631B36
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631B49
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631B5F
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631B75
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631B8B
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631BA1
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631BB7
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631BCD
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631BE3
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631BF9
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631C0F
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631C25
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631C3B
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631C51
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631C67
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631C7D
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631C93
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631CA9
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631CBF
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631CD5
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631CEC
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631D02
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631D18
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631D2E
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631D44
PyModule_AddIntConstant.PYTHON3 ref: 00007FFD93631D5A

Strings

ERROR_PRIVILEGE_NOT_HELD, xrefs: 00007FFD93631CCB
PSUTIL_CONN_NONE, xrefs: 00007FFD93631C5D
WINVER, xrefs: 00007FFD93631CE2
WINDOWS_10, xrefs: 00007FFD93631D50
MIB_TCP_STATE_FIN_WAIT1, xrefs: 00007FFD93631BD9
PSUTIL_DEBUG, xrefs: 00007FFD936318FD
ERROR_SERVICE_DOES_NOT_EXIST, xrefs: 00007FFD93631CB5
ABOVE_NORMAL_PRIORITY_CLASS, xrefs: 00007FFD93631ABE
MIB_TCP_STATE_CLOSE_WAIT, xrefs: 00007FFD93631B6B
MIB_TCP_STATE_CLOSING, xrefs: 00007FFD93631B55
IDLE_PRIORITY_CLASS, xrefs: 00007FFD93631B00
MIB_TCP_STATE_FIN_WAIT2, xrefs: 00007FFD93631BEF
REALTIME_PRIORITY_CLASS, xrefs: 00007FFD93631B2C
MIB_TCP_STATE_LISTEN, xrefs: 00007FFD93631B81
MIB_TCP_STATE_SYN_RCVD, xrefs: 00007FFD93631BC3
BELOW_NORMAL_PRIORITY_CLASS, xrefs: 00007FFD93631AD4
WINDOWS_8_1, xrefs: 00007FFD93631D3A
MIB_TCP_STATE_LAST_ACK, xrefs: 00007FFD93631C05
NORMAL_PRIORITY_CLASS, xrefs: 00007FFD93631B16
MIB_TCP_STATE_SYN_SENT, xrefs: 00007FFD93631BAD
_psutil_windows.TimeoutAbandoned, xrefs: 00007FFD93631A76
MIB_TCP_STATE_TIME_WAIT, xrefs: 00007FFD93631C1B, 00007FFD93631C31
ERROR_ACCESS_DENIED, xrefs: 00007FFD93631C89
MIB_TCP_STATE_ESTAB, xrefs: 00007FFD93631B97
_psutil_windows.TimeoutExpired, xrefs: 00007FFD93631A47
WINDOWS_VISTA, xrefs: 00007FFD93631CF8
WINDOWS_8, xrefs: 00007FFD93631D24
HIGH_PRIORITY_CLASS, xrefs: 00007FFD93631AEA
MIB_TCP_STATE_DELETE_TCB, xrefs: 00007FFD93631C47
version, xrefs: 00007FFD93631AA8
MIB_TCP_STATE_CLOSED, xrefs: 00007FFD93631B3F
TimeoutExpired, xrefs: 00007FFD93631A56
TimeoutAbandoned, xrefs: 00007FFD93631A85
_psutil_windows.Error, xrefs: 00007FFD936319F1
ERROR_INVALID_NAME, xrefs: 00007FFD93631C9F
WINDOWS_7, xrefs: 00007FFD93631D0E
INFINITE, xrefs: 00007FFD93631C73

Memory Dump Source

Source File: 00000002.00000002.3401786846.00007FFD93631000.00000020.00000001.01000000.00000033.sdmp, Offset: 00007FFD93630000, based on PE: true

Associated: 00000002.00000002.3401763718.00007FFD93630000.00000002.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401813572.00007FFD9363B000.00000002.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401835610.00007FFD93640000.00000004.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401855906.00007FFD93641000.00000002.00000001.01000000.00000033.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93630000_7EznMik8Fw.jbxd

Similarity

API ID: Module_$Constant$Err_$Exception$Eval_ObjectThread$Create2CriticalDeallocFilenameFromInfoInitializeLibraryLoadRestoreSaveSectionStateSystemVersionWindowsWithgetenv
String ID: ABOVE_NORMAL_PRIORITY_CLASS$BELOW_NORMAL_PRIORITY_CLASS$ERROR_ACCESS_DENIED$ERROR_INVALID_NAME$ERROR_PRIVILEGE_NOT_HELD$ERROR_SERVICE_DOES_NOT_EXIST$HIGH_PRIORITY_CLASS$IDLE_PRIORITY_CLASS$INFINITE$MIB_TCP_STATE_CLOSED$MIB_TCP_STATE_CLOSE_WAIT$MIB_TCP_STATE_CLOSING$MIB_TCP_STATE_DELETE_TCB$MIB_TCP_STATE_ESTAB$MIB_TCP_STATE_FIN_WAIT1$MIB_TCP_STATE_FIN_WAIT2$MIB_TCP_STATE_LAST_ACK$MIB_TCP_STATE_LISTEN$MIB_TCP_STATE_SYN_RCVD$MIB_TCP_STATE_SYN_SENT$MIB_TCP_STATE_TIME_WAIT$NORMAL_PRIORITY_CLASS$PSUTIL_CONN_NONE$PSUTIL_DEBUG$REALTIME_PRIORITY_CLASS$TimeoutAbandoned$TimeoutExpired$WINDOWS_10$WINDOWS_7$WINDOWS_8$WINDOWS_8_1$WINDOWS_VISTA$WINVER$_psutil_windows.Error$_psutil_windows.TimeoutAbandoned$_psutil_windows.TimeoutExpired$version
API String ID: 887074641-2468274236
Opcode ID: 4656843fcfd9a4fab3e528a616cb0e139eca0cf32d439c792de87cd9eebb126e
Instruction ID: 1d799b28fe5c60153b8b114ce0bc4cb7470cecbfa81944d607d651d85e95df30
Opcode Fuzzy Hash: 4656843fcfd9a4fab3e528a616cb0e139eca0cf32d439c792de87cd9eebb126e
Instruction Fuzzy Hash: A7C16C24B1CA0281FA78DB91E97437823A9EF89BD1F800035DD6E637A8DF6DE149C711

Function 00007FFD938E1992 Relevance: 58.0, APIs: 31, Strings: 2, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD938FD32F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FD347
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FD357
ERR_new.LIBCRYPTO-3 ref: 00007FFD938FD381
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FD399
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FD3AA
ERR_new.LIBCRYPTO-3 ref: 00007FFD938FD3AF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FD3C7
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FD3D8
CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFD938FD411
CRYPTO_THREAD_lock_new.LIBCRYPTO-3 ref: 00007FFD938FD428
ERR_new.LIBCRYPTO-3 ref: 00007FFD938FD439
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FD451
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FD462
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938FD477
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD938FD499
OPENSSL_LH_new.LIBCRYPTO-3 ref: 00007FFD938FD510
X509_STORE_new.LIBCRYPTO-3 ref: 00007FFD938FD522
CTLOG_STORE_new_ex.LIBCRYPTO-3 ref: 00007FFD938FD53A
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD938FD5CE
X509_VERIFY_PARAM_new.LIBCRYPTO-3 ref: 00007FFD938FD5DB
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFD938FD61E
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFD938FD633
CRYPTO_new_ex_data.LIBCRYPTO-3 ref: 00007FFD938FD657
CRYPTO_secure_zalloc.LIBCRYPTO-3 ref: 00007FFD938FD676
RAND_bytes_ex.LIBCRYPTO-3 ref: 00007FFD938FD6CB
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FFD938FD6E5
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FFD938FD703
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FFD938FD728
ERR_new.LIBCRYPTO-3 ref: 00007FFD938FD786
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FD79E

Strings

SSL_CTX_new_ex, xrefs: 00007FFD938FD334, 00007FFD938FD386, 00007FFD938FD3B4, 00007FFD938FD43E, 00007FFD938FD78B
..\s\ssl\ssl_lib.c, xrefs: 00007FFD938FD340, 00007FFD938FD392, 00007FFD938FD3C0, 00007FFD938FD405, 00007FFD938FD44A, 00007FFD938FD46D, 00007FFD938FD48F, 00007FFD938FD66A, 00007FFD938FD797

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$R_set_error$D_priv_bytes_ex$L_sk_new_nullX509_$D_bytes_exD_lock_newE_newE_new_exH_newL_sk_numM_newO_freeO_new_ex_dataO_secure_zallocO_strdupO_zalloc
String ID: ..\s\ssl\ssl_lib.c$SSL_CTX_new_ex
API String ID: 864562269-27091654
Opcode ID: 0ef21fb0b24aa75d52d15136eef25518695f37dfed3ffb2822b27bc7d2223680
Instruction ID: b91f0be301ea84de2a39f4f96acd2b98b0f26c38b70aaa307f6d810cdc3e7038
Opcode Fuzzy Hash: 0ef21fb0b24aa75d52d15136eef25518695f37dfed3ffb2822b27bc7d2223680
Instruction Fuzzy Hash: 00C18C65B19B42A1F774ABE1D8717F92398AF84784F480134DE4D2A6CAEF3DE844C750

Function 00007FFD93631E90 Relevance: 43.9, APIs: 19, Strings: 6, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyList_New.PYTHON3 ref: 00007FFD93631EA0
PyErr_SetFromWindowsErr.PYTHON3 ref: 00007FFD93631EF3
_Py_Dealloc.PYTHON3 ref: 00007FFD93631F03
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFD93631F11

Strings

psutil/arch/windows\cpu.c, xrefs: 00007FFD93631F57
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 00007FFD93631F7B
NtQuerySystemInformation(SystemProcessorPerformanceInformation), xrefs: 00007FFD9363200D
psutil-debug [%s:%d]> , xrefs: 00007FFD93631F61
GetSystemInfo() failed to retrieve CPU count, xrefs: 00007FFD93631FB4
(ddddd), xrefs: 00007FFD93632042

Memory Dump Source

Source File: 00000002.00000002.3401786846.00007FFD93631000.00000020.00000001.01000000.00000033.sdmp, Offset: 00007FFD93630000, based on PE: true

Associated: 00000002.00000002.3401763718.00007FFD93630000.00000002.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401813572.00007FFD9363B000.00000002.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401835610.00007FFD93640000.00000004.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401855906.00007FFD93641000.00000002.00000001.01000000.00000033.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93630000_7EznMik8Fw.jbxd

Similarity

API ID: DeallocErr_FromList_Windowsfree
String ID: (ddddd)$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$NtQuerySystemInformation(SystemProcessorPerformanceInformation)$psutil-debug [%s:%d]> $psutil/arch/windows\cpu.c
API String ID: 2064544276-4027580629
Opcode ID: 7190dbfe5ddc8fd9770f88d7c9040de05d44c9cbbe8f5b86af6aa6a4fad55d9a
Instruction ID: 2bc91dd04648835552bf918b45c8c6f4f8f10d55bfe26d05207b2a0090fb71d7
Opcode Fuzzy Hash: 7190dbfe5ddc8fd9770f88d7c9040de05d44c9cbbe8f5b86af6aa6a4fad55d9a
Instruction Fuzzy Hash: 7171A731F18B428AF67A9F75A460279A3E9AF95B80B044336ED2F72754EF3CE4458700

Function 00007FFD93637DB0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFD93637DE7
OpenProcessToken.ADVAPI32 ref: 00007FFD93637DFB
GetLastError.KERNEL32 ref: 00007FFD93637E09
ImpersonateSelf.ADVAPI32 ref: 00007FFD93637E19
OpenProcessToken.ADVAPI32 ref: 00007FFD93637E46

Part of subcall function 00007FFD93631070: GetLastError.KERNEL32 ref: 00007FFD93631092
Part of subcall function 00007FFD93631070: PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFD936310B5

Part of subcall function 00007FFD93637D10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFD93637D22
Part of subcall function 00007FFD93637D10: fprintf.MSPDB140-MSVCRT ref: 00007FFD93637D3F
Part of subcall function 00007FFD93637D10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFD93637D49
Part of subcall function 00007FFD93637D10: fprintf.MSPDB140-MSVCRT ref: 00007FFD93637D59
Part of subcall function 00007FFD93637D10: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFD93637D63
Part of subcall function 00007FFD93637D10: fprintf.MSPDB140-MSVCRT ref: 00007FFD93637D73
Part of subcall function 00007FFD93637D10: GetLastError.KERNEL32 ref: 00007FFD93637D78
Part of subcall function 00007FFD93637D10: PyErr_WarnEx.PYTHON3 ref: 00007FFD93637D9A

GetLastError.KERNEL32 ref: 00007FFD93637E66
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFD93637E8D

Strings

ImpersonateSelf, xrefs: 00007FFD93637E23
LookupPrivilegeValue, xrefs: 00007FFD93637ED7
OpenProcessToken, xrefs: 00007FFD93637E50, 00007FFD93637E6C
(originated from %s), xrefs: 00007FFD93637E75, 00007FFD93637EE0, 00007FFD93637F56
AdjustTokenPrivileges, xrefs: 00007FFD93637F4D, 00007FFD93637FB4
SeDebugPrivilege, xrefs: 00007FFD93637EBE

Memory Dump Source

Source File: 00000002.00000002.3401786846.00007FFD93631000.00000020.00000001.01000000.00000033.sdmp, Offset: 00007FFD93630000, based on PE: true

Associated: 00000002.00000002.3401763718.00007FFD93630000.00000002.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401813572.00007FFD9363B000.00000002.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401835610.00007FFD93640000.00000004.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401855906.00007FFD93641000.00000002.00000001.01000000.00000033.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93630000_7EznMik8Fw.jbxd

Similarity

API ID: ErrorLast$Err_Process__acrt_iob_funcfprintf$FilenameFromOpenTokenWindowsWith$CurrentImpersonateSelfWarn
String ID: (originated from %s)$AdjustTokenPrivileges$ImpersonateSelf$LookupPrivilegeValue$OpenProcessToken$SeDebugPrivilege
API String ID: 2544101647-3705996988
Opcode ID: 34da3196203b84411ab0fd01f7fc5e768038530ca3460100517b82b84452998e
Instruction ID: 7b96e3161c457262686b4a201aa15f997dc40c63d453c71e0feb4cab4d1f2886
Opcode Fuzzy Hash: 34da3196203b84411ab0fd01f7fc5e768038530ca3460100517b82b84452998e
Instruction Fuzzy Hash: FA516335B1CB4681F7789BA1E8602B973A8FF84784F400436E5AE63669EF7CE509C740

Function 00007FFD936313D0 Relevance: 89.5, APIs: 27, Strings: 24, Instructions: 229
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyEval_SaveThread.PYTHON3 ref: 00007FFD936313DA
LoadLibraryA.KERNEL32 ref: 00007FFD936313EA
PyEval_RestoreThread.PYTHON3 ref: 00007FFD936313F6
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFD9363140A
GetProcAddress.KERNEL32 ref: 00007FFD9363141C
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFD93631430
FreeLibrary.KERNEL32 ref: 00007FFD93631439
GetModuleHandleA.KERNEL32 ref: 00007FFD93631466
GetProcAddress.KERNEL32 ref: 00007FFD93631484
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFD93631498
GetModuleHandleA.KERNEL32 ref: 00007FFD936314C5
GetProcAddress.KERNEL32 ref: 00007FFD936314E3
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFD936314F7
PyEval_SaveThread.PYTHON3 ref: 00007FFD9363151D
LoadLibraryA.KERNEL32 ref: 00007FFD9363152D
PyEval_RestoreThread.PYTHON3 ref: 00007FFD93631539
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFD9363154D
GetProcAddress.KERNEL32 ref: 00007FFD93631574
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFD93631588
FreeLibrary.KERNEL32 ref: 00007FFD93631591

Strings

WTSFreeMemory, xrefs: 00007FFD936317E0
GetExtendedTcpTable, xrefs: 00007FFD936315DA
NtQueryInformationProcess, xrefs: 00007FFD9363147A, 00007FFD9363148F
kernel32, xrefs: 00007FFD936316CF, 00007FFD936316E1, 00007FFD93631751, 00007FFD93631763, 00007FFD936317A0
GetActiveProcessorCount, xrefs: 00007FFD9363176C, 00007FFD93631781
RtlNtStatusToDosErrorNoTeb, xrefs: 00007FFD936316AC
ntdll, xrefs: 00007FFD9363164A, 00007FFD9363166D, 00007FFD93631690, 00007FFD936316B3
wtsapi32.dll, xrefs: 00007FFD936317BA, 00007FFD936317D4, 00007FFD936317EE
WTSEnumerateSessionsW, xrefs: 00007FFD936317AC
NtQueryObject, xrefs: 00007FFD9363156A, 00007FFD9363157F
iphlpapi.dll, xrefs: 00007FFD936315E1, 00007FFD93631604
ntdll.dll, xrefs: 00007FFD936313E0, 00007FFD93631401, 00007FFD93631458, 00007FFD93631471, 00007FFD936314B7, 00007FFD936314D0, 00007FFD93631523, 00007FFD93631544, 00007FFD936315BE, 00007FFD93631627, 00007FFD93631735
NtResumeProcess, xrefs: 00007FFD93631666
RtlIpv4AddressToStringA, xrefs: 00007FFD936315B0
RtlGetVersion, xrefs: 00007FFD93631620
WTSQuerySessionInformationW, xrefs: 00007FFD936317C6
NtSetInformationProcess, xrefs: 00007FFD936314D9, 00007FFD936314EE
NtSuspendProcess, xrefs: 00007FFD93631643
GetLogicalProcessorInformationEx, xrefs: 00007FFD93631792
GetTickCount64, xrefs: 00007FFD936316EA, 00007FFD936316FF
RtlIpv6AddressToStringA, xrefs: 00007FFD93631727
GetExtendedUdpTable, xrefs: 00007FFD936315FD
NtQueryVirtualMemory, xrefs: 00007FFD93631689
NtQuerySystemInformation, xrefs: 00007FFD93631412, 00007FFD93631427

Memory Dump Source

Source File: 00000002.00000002.3401786846.00007FFD93631000.00000020.00000001.01000000.00000033.sdmp, Offset: 00007FFD93630000, based on PE: true

Associated: 00000002.00000002.3401763718.00007FFD93630000.00000002.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401813572.00007FFD9363B000.00000002.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401835610.00007FFD93640000.00000004.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401855906.00007FFD93641000.00000002.00000001.01000000.00000033.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93630000_7EznMik8Fw.jbxd

Similarity

API ID: Err_FilenameFromWindowsWith$AddressEval_LibraryProcThread$FreeHandleLoadModuleRestoreSave
String ID: GetActiveProcessorCount$GetExtendedTcpTable$GetExtendedUdpTable$GetLogicalProcessorInformationEx$GetTickCount64$NtQueryInformationProcess$NtQueryObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtResumeProcess$NtSetInformationProcess$NtSuspendProcess$RtlGetVersion$RtlIpv4AddressToStringA$RtlIpv6AddressToStringA$RtlNtStatusToDosErrorNoTeb$WTSEnumerateSessionsW$WTSFreeMemory$WTSQuerySessionInformationW$iphlpapi.dll$kernel32$ntdll$ntdll.dll$wtsapi32.dll
API String ID: 3787047288-761253638
Opcode ID: 6b7c78cd98652e75907c508de1284e9f0e804c7fc3037098929c04c6a191e3dd
Instruction ID: 3b68a4345eccb89d86eef76062a1c7aaf49a92b1ead979f0cda47c3ef3d7e08c
Opcode Fuzzy Hash: 6b7c78cd98652e75907c508de1284e9f0e804c7fc3037098929c04c6a191e3dd
Instruction Fuzzy Hash: 49C1F420F0DB0780FA68AB94F87827923E9EF88740F845535E82D673A9EF7CE1558354

Function 00007FFD938E14BF Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 243
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FFD9393E73A
SetLastError.KERNEL32 ref: 00007FFD9393E741
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393E820
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393E838
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393E861
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393E885
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393E8A7
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393E8C8
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393E8EA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393E902
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393E939
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393EA00
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393EA18
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393EA32
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393EA4A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9393EA5B
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFD9393EA69

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FFD9393E831, 00007FFD9393E8FB, 00007FFD9393EA11, 00007FFD9393EA43
state_machine, xrefs: 00007FFD9393E82A, 00007FFD9393E8F4, 00007FFD9393EA05, 00007FFD9393EA37

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$R_set_debug$ErrorLastM_freeR_clear_errorR_set_error
String ID: ..\s\ssl\statem\statem.c$state_machine
API String ID: 1370845099-1722249466
Opcode ID: 6f8aa62c0a17cd257a7cac7c3db44b12b48ed95985bfa37342f9ed60703b21dc
Instruction ID: a39b66c6803bae01f34070809958bee32b945c45b8a330921978b68ae03fa4a7
Opcode Fuzzy Hash: 6f8aa62c0a17cd257a7cac7c3db44b12b48ed95985bfa37342f9ed60703b21dc
Instruction Fuzzy Hash: D2A18EB2F0C242A5FBB8ABA5D4613BD239DEF40B44F144431DA4E666D6CE3DE881C781

Function 00007FFD938E1C62 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939454E4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939454FC
ERR_clear_error.LIBCRYPTO-3 ref: 00007FFD93945531
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93945546
X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FFD93945551
ERR_new.LIBCRYPTO-3 ref: 00007FFD93945587
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394559F
ERR_new.LIBCRYPTO-3 ref: 00007FFD939455E4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939455FC

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD939454F5, 00007FFD93945598, 00007FFD939455F5, 00007FFD939456C7
tls_post_process_server_certificate, xrefs: 00007FFD939454E9, 00007FFD9394558C, 00007FFD939455E9, 00007FFD939456BB

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$L_sk_valueR_clear_errorX509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$tls_post_process_server_certificate
API String ID: 2779586248-3767186838
Opcode ID: db8201a799e0baeb7e7da45e6d94f051912b60767bec020adcc90b3d0adbc0ec
Instruction ID: 44982061845d9851eb0aac0d84819a8d5c6c71145e54e8c61b5cc6a2c53f0dad
Opcode Fuzzy Hash: db8201a799e0baeb7e7da45e6d94f051912b60767bec020adcc90b3d0adbc0ec
Instruction Fuzzy Hash: 3A51AF65B19642A2F770EBE5D4643B92398EF84B84F544031DD0D6B7D6DF2DE881CB00

Function 00007FFD938E14F1 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FFD9392779F
ERR_new.LIBCRYPTO-3 ref: 00007FFD9392783B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93927853
SetLastError.KERNEL32 ref: 00007FFD939278A2
BIO_read.LIBCRYPTO-3 ref: 00007FFD939278C9
BIO_test_flags.LIBCRYPTO-3 ref: 00007FFD939278EA
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD93927900
ERR_new.LIBCRYPTO-3 ref: 00007FFD93927958
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93927970
ERR_new.LIBCRYPTO-3 ref: 00007FFD939279C0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939279D8

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFD9392784C, 00007FFD93927969, 00007FFD939279D1
ssl3_read_n, xrefs: 00007FFD93927840, 00007FFD9392795D, 00007FFD939279C5

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$ErrorLastO_ctrlO_readO_test_flagsmemmove
String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_read_n
API String ID: 3874383451-4226281315
Opcode ID: 3ca2100bb6b87b098cae2558db268160d918adefb8b476431aa8d90b6f162e8a
Instruction ID: cd27e3009ef1b49fe45aa20c8c314559db4267e3e117dcace1ad92ba56619c07
Opcode Fuzzy Hash: 3ca2100bb6b87b098cae2558db268160d918adefb8b476431aa8d90b6f162e8a
Instruction Fuzzy Hash: 67918E36B08B92A2FB709FA9D5647B923A8EF44B98F544131DE4D27B86EF38D445C300

Function 00007FFD9393E240 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FFD9393E4D4, 00007FFD9393E511, 00007FFD9393E53E, 00007FFD9393E5B1
read_state_machine, xrefs: 00007FFD9393E4CD, 00007FFD9393E50A, 00007FFD9393E532, 00007FFD9393E5A5

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem.c$read_state_machine
API String ID: 0-3323778802
Opcode ID: 14377edc59a60446f09f780bfe0d0aa6ceb5de1d18d0f26ea132c90706a724b0
Instruction ID: 90de249faece63da762d6ceeac2a964639be815edf8eac0bbbe28b743efc9dad
Opcode Fuzzy Hash: 14377edc59a60446f09f780bfe0d0aa6ceb5de1d18d0f26ea132c90706a724b0
Instruction Fuzzy Hash: A9919BB2F08646A1EB38AFA4D4643B92398EF84B48F544036DE0E67795DF3DE846C740

Function 00007FFD9393EC70 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3(?,?,?,-00000031,00007FFD9393E9C6), ref: 00007FFD9393ED22
ERR_set_debug.LIBCRYPTO-3(?,?,?,-00000031,00007FFD9393E9C6), ref: 00007FFD9393ED3A

Strings

write_state_machine, xrefs: 00007FFD9393ED2C, 00007FFD9393F01B
..\s\ssl\statem\statem.c, xrefs: 00007FFD9393ED33, 00007FFD9393F022

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem.c$write_state_machine
API String ID: 193678381-552286378
Opcode ID: 1edee16b17f7b7a209ddbeed6cd636bdd8764bdbe6572802cc707b3b873bb90e
Instruction ID: 3ba310edf5f20d55f7e7d90be3119ed9e7a45b0cdbabc8ef9e0b87d7dc5eed97
Opcode Fuzzy Hash: 1edee16b17f7b7a209ddbeed6cd636bdd8764bdbe6572802cc707b3b873bb90e
Instruction Fuzzy Hash: 29A19273B08642A1EB78DFA5D8643B923A8FF80B88F444136DA0E67695DF7DE945C700

Function 00007FFD93950710 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93950836
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395084E
ERR_new.LIBCRYPTO-3 ref: 00007FFD939508CE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939508E6

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93950847, 00007FFD939508DF
tls_get_message_header, xrefs: 00007FFD9395083B, 00007FFD939508D3

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_get_message_header
API String ID: 193678381-2714770296
Opcode ID: 0a675c68133e8178ac648a78a03b7d1437f40432096ecb796daf1537fba5ad51
Instruction ID: 867a00acbe6f7f00ab0ea81f78aeae3e54bc4d699cc23c04113a56e9e9419616
Opcode Fuzzy Hash: 0a675c68133e8178ac648a78a03b7d1437f40432096ecb796daf1537fba5ad51
Instruction Fuzzy Hash: AE614D32B08781A5EBB08FA5D4607A937A8FB45B48F088035DF8D67799DF38D895C710

Function 00007FFD938FFAE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD938FFB00
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FFB18
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FFB28
ASYNC_get_current_job.LIBCRYPTO-3 ref: 00007FFD938FFB75

Strings

SSL_do_handshake, xrefs: 00007FFD938FFB05
..\s\ssl\ssl_lib.c, xrefs: 00007FFD938FFB11

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: C_get_current_jobR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_do_handshake
API String ID: 2134390360-2964568172
Opcode ID: c91630741219631a69d9c5f3432363629406958cc77146902cc34db31b5e4eda
Instruction ID: cf4e8a57caac9a01aa5f01fb76589d74393db7a9f51b07c88375b6ed96fc2d1f
Opcode Fuzzy Hash: c91630741219631a69d9c5f3432363629406958cc77146902cc34db31b5e4eda
Instruction Fuzzy Hash: 4021A436F0874692E764EBB5E4613BE2359EF88B84F580231EE4D227D6DF3CE5918640

Function 00007FFD936312C0 Relevance: 10.5, APIs: 7, Instructions: 37
librarythreadloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyEval_SaveThread.PYTHON3 ref: 00007FFD936312DA
LoadLibraryA.KERNEL32 ref: 00007FFD936312E6
PyEval_RestoreThread.PYTHON3 ref: 00007FFD936312F2
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFD93631302
GetProcAddress.KERNEL32 ref: 00007FFD93631310
PyErr_SetFromWindowsErrWithFilename.PYTHON3 ref: 00007FFD93631320
FreeLibrary.KERNEL32 ref: 00007FFD93631329

Memory Dump Source

Source File: 00000002.00000002.3401786846.00007FFD93631000.00000020.00000001.01000000.00000033.sdmp, Offset: 00007FFD93630000, based on PE: true

Associated: 00000002.00000002.3401763718.00007FFD93630000.00000002.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401813572.00007FFD9363B000.00000002.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401835610.00007FFD93640000.00000004.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401855906.00007FFD93641000.00000002.00000001.01000000.00000033.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93630000_7EznMik8Fw.jbxd

Similarity

API ID: Err_Eval_FilenameFromLibraryThreadWindowsWith$AddressFreeLoadProcRestoreSave
String ID:
API String ID: 568911590-0
Opcode ID: e2200b3415209b6f4be3470a672ca2eac9ae6c36c8dafb9bbec9a9066c3d2c4c
Instruction ID: d68164164f719eeb68fe025d1d0602c8648eda5b062048387c8beaf4eb5dbffa
Opcode Fuzzy Hash: e2200b3415209b6f4be3470a672ca2eac9ae6c36c8dafb9bbec9a9066c3d2c4c
Instruction Fuzzy Hash: FB014F20B1CB4681FA2CABA2B92813E63A9FF88FC0B444034ED5E57B59DF3CD0458744

Function 00007FFD93631DC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimes.KERNEL32 ref: 00007FFD93631DD3
PyErr_SetFromWindowsErr.PYTHON3 ref: 00007FFD93631DDF
Py_BuildValue.PYTHON3 ref: 00007FFD93631E82

Strings

(ddd), xrefs: 00007FFD93631DF4

Memory Dump Source

Source File: 00000002.00000002.3401786846.00007FFD93631000.00000020.00000001.01000000.00000033.sdmp, Offset: 00007FFD93630000, based on PE: true

Associated: 00000002.00000002.3401763718.00007FFD93630000.00000002.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401813572.00007FFD9363B000.00000002.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401835610.00007FFD93640000.00000004.00000001.01000000.00000033.sdmpDownload File
Associated: 00000002.00000002.3401855906.00007FFD93641000.00000002.00000001.01000000.00000033.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93630000_7EznMik8Fw.jbxd

Similarity

API ID: BuildErr_FromSystemTimesValueWindows
String ID: (ddd)
API String ID: 2325294781-2401937087
Opcode ID: ba0bdbf672466f0367906313a703a410643c45962e3f53d94245850bb14888e0
Instruction ID: 1e5f5903c6605eb1d3706f2bd2dc6822b70f2bdc9e9b5610a9385ef8fba851c7
Opcode Fuzzy Hash: ba0bdbf672466f0367906313a703a410643c45962e3f53d94245850bb14888e0
Instruction Fuzzy Hash: 9511BC31F29F414FD567DB759950525E3A9AFA5790B448322F51FB2E10E72CE0D68B00

Function 00007FFD939074A0 Relevance: 6.0, APIs: 4, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_set_mark.LIBCRYPTO-3 ref: 00007FFD939074CC
OBJ_nid2sn.LIBCRYPTO-3 ref: 00007FFD939074D3
EVP_CIPHER_fetch.LIBCRYPTO-3 ref: 00007FFD939074E1
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFD939074E9

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: J_nid2snR_fetchR_pop_to_markR_set_mark
String ID:
API String ID: 2772354928-0
Opcode ID: 9d6a64450acf58a63a50e4c19100a97fdf4d2fc7c8484d09c1bb12015f6b24b3
Instruction ID: 2b1383b5bc6ec61a162dc782ffb9f7e7b60b62b2b6637d6610a47a09622a1fa6
Opcode Fuzzy Hash: 9d6a64450acf58a63a50e4c19100a97fdf4d2fc7c8484d09c1bb12015f6b24b3
Instruction Fuzzy Hash: 37F0EC05F0D74251EA6477D2B4553BD56595F88BC0F084434FD4D77B8BDD2CE5824B00

Function 00007FFD9393E5EC Relevance: 4.8, APIs: 3, Instructions: 344COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FFD9393E73A
SetLastError.KERNEL32 ref: 00007FFD9393E741
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFD9393EA69

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: ce68793f5ed94765da0cf06069d6cda8a1f14ed55aa43607596081dc107df58f
Instruction ID: 1da6356f7ef5f4f704dcd41a4b478390aea0b7eb6b6c50d3153dd0b3c647c4e7
Opcode Fuzzy Hash: ce68793f5ed94765da0cf06069d6cda8a1f14ed55aa43607596081dc107df58f
Instruction Fuzzy Hash: 6B31B4B7F086029AF7B89E9594A137D27A9FF41B44F584431DE4963685DF38E882CB40

Function 00007FFD938E1DF2 Relevance: 4.6, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FFD9393E73A
SetLastError.KERNEL32 ref: 00007FFD9393E741
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFD9393EA69

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: 30f5a756a2453722bd5fc7c60f00636787785f570310c9cdf96fb774af82a049
Instruction ID: baa145feafd21500d8803d2360332f040ee48cbfa2cf5df0a93cf3046b6d7100
Opcode Fuzzy Hash: 30f5a756a2453722bd5fc7c60f00636787785f570310c9cdf96fb774af82a049
Instruction Fuzzy Hash: BB316DB3F0824299F7B8AEA5946037D2799EF40B44F584431EE4E66685DE3DE881CB41

Function 00007FFD93661490 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FFD936614B5

Memory Dump Source

Source File: 00000002.00000002.3401896739.00007FFD93651000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FFD93650000, based on PE: true

Associated: 00000002.00000002.3401877249.00007FFD93650000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3402002576.00007FFD9377C000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3402037144.00007FFD937AA000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3402061018.00007FFD937AF000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93650000_7EznMik8Fw.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 92d82e4b214818c158f58746d604a038a40c5e57c576eefab9a689c2dc8594a3
Instruction ID: 7e8d3870e6407a968e931d3735cf8e9e9ef57694a4654d496a75ceb17f262d19
Opcode Fuzzy Hash: 92d82e4b214818c158f58746d604a038a40c5e57c576eefab9a689c2dc8594a3
Instruction Fuzzy Hash: D7A1EC65F0AB8781FEB48BD5A47437832ADBF45B88F140935C92EA7790DF6CE4A18340

Function 00007FFD9393E330 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBCRYPTO-3(?,?,?,?,-00000031,?,00007FFD9393E9A4), ref: 00007FFD9393E3D7

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: M_grow_clean
String ID:
API String ID: 964628749-0
Opcode ID: ff409e93fcb0d36c1aaad829d7e6a47c84e60de949b34c47c74b208e88b9b461
Instruction ID: 0070c812b4416811be10ce31e414d62090d95f1b69c8aae85c4ac1d5cd03e1dd
Opcode Fuzzy Hash: ff409e93fcb0d36c1aaad829d7e6a47c84e60de949b34c47c74b208e88b9b461
Instruction Fuzzy Hash: DE415BB2F0968696EB389F65D0643792799EF44B88F188135CE4D67798DF38E8418700

Non-executed Functions

Function 00007FFD93957820 Relevance: 118.0, APIs: 63, Strings: 4, Instructions: 767COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957888
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD939578A0
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD9395797E
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957996
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD939579AB
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD939579C3
OPENSSL_sk_free.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957C8D
OPENSSL_sk_free.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957C96
CRYPTO_free.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957CAF
CRYPTO_free.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957CC8
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957CE5
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957CFD
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957D0D
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957D25
ERR_new.LIBCRYPTO-3 ref: 00007FFD93957D57
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93957D6F
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957E50
OPENSSL_sk_num.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957EAA
OPENSSL_sk_value.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957EB9
OPENSSL_sk_num.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957ECA
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957ED3
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957EEB
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957F27
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93958D5C), ref: 00007FFD93957F3F
CRYPTO_memcmp.LIBCRYPTO-3 ref: 00007FFD9395805B
ERR_new.LIBCRYPTO-3 ref: 00007FFD939580BF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939580D7
ERR_new.LIBCRYPTO-3 ref: 00007FFD939581EF
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD9395821A
OPENSSL_sk_dup.LIBCRYPTO-3 ref: 00007FFD93958226
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD93958239
OPENSSL_sk_dup.LIBCRYPTO-3 ref: 00007FFD93958245
ERR_new.LIBCRYPTO-3 ref: 00007FFD93958287
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395829F
ERR_new.LIBCRYPTO-3 ref: 00007FFD939582D7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939582EF
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93958310
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93958330
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD9395834D
ERR_new.LIBCRYPTO-3 ref: 00007FFD93958368
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93958380
ERR_new.LIBCRYPTO-3 ref: 00007FFD939583C3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939583DB
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD9395841C
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93958440
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD939584B1
ERR_new.LIBCRYPTO-3 ref: 00007FFD939584C6
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD93958517
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD93958520
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93958539
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93958552

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93957899, 00007FFD9395798F, 00007FFD939579BC, 00007FFD93957A35, 00007FFD93957AA8, 00007FFD93957C67, 00007FFD93957CA2, 00007FFD93957CBB, 00007FFD93957CF6, 00007FFD93957D1E, 00007FFD93957D68, 00007FFD93957EE4, 00007FFD93957F38, 00007FFD939580D0, 00007FFD93958298, 00007FFD939582E8, 00007FFD93958379, 00007FFD939583D4, 00007FFD9395852C, 00007FFD93958545
@, xrefs: 00007FFD93957F54
tls_early_post_process_client_hello, xrefs: 00007FFD9395788D, 00007FFD93957983, 00007FFD939579B0, 00007FFD93957A2E, 00007FFD93957AA1, 00007FFD93957C5B, 00007FFD93957CEA, 00007FFD93957D12, 00007FFD93957D5C, 00007FFD93957ED8, 00007FFD93957F2C, 00007FFD939580C9, 00007FFD939581F4, 00007FFD9395828C, 00007FFD939582DC, 00007FFD9395836D, 00007FFD939583C8
P, xrefs: 00007FFD9395784F

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$R_set_debug$L_sk_free$L_sk_num$O_free$L_sk_value$L_sk_dup$O_memcmpmemcpy
String ID: ..\s\ssl\statem\statem_srvr.c$@$P$tls_early_post_process_client_hello
API String ID: 3172855559-1173447675
Opcode ID: f4ebc71df91df51bf9ae05e26b6cd4839ddc4547f31832c535cc23f7216b7177
Instruction ID: f0bf262404de07c6c06f56baa6f65f8408ba2352dfbaa8a82c6d450aaee31025
Opcode Fuzzy Hash: f4ebc71df91df51bf9ae05e26b6cd4839ddc4547f31832c535cc23f7216b7177
Instruction Fuzzy Hash: 53726D66B08782A5EB349FE1D8603B92399EF84B88F544035DE4E67795CF3DE981C740

Function 00007FFD938E21DF Relevance: 110.7, APIs: 57, Strings: 6, Instructions: 483COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_new.LIBCRYPTO-3 ref: 00007FFD93911A53
ERR_new.LIBCRYPTO-3 ref: 00007FFD93911A64
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93911A7C
ERR_new.LIBCRYPTO-3 ref: 00007FFD93911AB1
COMP_CTX_free.LIBCRYPTO-3 ref: 00007FFD93911ACE
COMP_CTX_new.LIBCRYPTO-3 ref: 00007FFD93911AE7
ERR_new.LIBCRYPTO-3 ref: 00007FFD93911AF8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93911B10
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD93911BE5
ERR_new.LIBCRYPTO-3 ref: 00007FFD93911BF2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93912148

Strings

..\s\ssl\t1_enc.c, xrefs: 00007FFD93911A75, 00007FFD93911B09, 00007FFD93912141
tls-mac-size, xrefs: 00007FFD9391208C
tls-version, xrefs: 00007FFD93912076
tls_provider_set_tls_params, xrefs: 00007FFD93912135
HMAC, xrefs: 00007FFD93911DD6
tls1_change_cipher_state, xrefs: 00007FFD93911A6E, 00007FFD93911AB6, 00007FFD93911B02, 00007FFD93911D89, 00007FFD93911EB5, 00007FFD93911ED3, 00007FFD93911FA2, 00007FFD93911FCE, 00007FFD93912018

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$R_set_debugX_new$X_free
String ID: ..\s\ssl\t1_enc.c$HMAC$tls-mac-size$tls-version$tls1_change_cipher_state$tls_provider_set_tls_params
API String ID: 1274617517-1172825828
Opcode ID: 1b41b9958f7dc289b5624f605a113bbca6768147db7a2d816eb58ff6c9a32524
Instruction ID: 6ff2ff84e3f1e8ce529819d0b9169fc95b0da41998619eeeee800f998ed26d88
Opcode Fuzzy Hash: 1b41b9958f7dc289b5624f605a113bbca6768147db7a2d816eb58ff6c9a32524
Instruction Fuzzy Hash: F7229066B08B86A1E674DBE5D4613B923A8FF89B88F404131DE4D63792DF3CE591CB00

Function 00007FFD9390B700 Relevance: 79.0, APIs: 43, Strings: 2, Instructions: 248COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B765
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B77D
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B78B
OPENSSL_sk_num.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B7AB
OPENSSL_sk_value.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B7B9
OPENSSL_sk_num.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B7E5
X509_get_pubkey.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B7F9
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B82F
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B847
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B858
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B862
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B87A
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B889
EVP_PKEY_missing_parameters.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B896
EVP_PKEY_missing_parameters.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B8A2
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B8AB
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B8C3
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B8D4
EVP_PKEY_copy_parameters.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B8E4
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B8ED
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B905
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B916
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B97F
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B997
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390B9A8
EVP_PKEY_free.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9390A9C7), ref: 00007FFD9390BB18

Strings

ssl_set_cert_and_key, xrefs: 00007FFD9390B76A, 00007FFD9390B834, 00007FFD9390B867, 00007FFD9390B8B0, 00007FFD9390B8F2, 00007FFD9390B93D, 00007FFD9390B984, 00007FFD9390B9E7, 00007FFD9390BA31
..\s\ssl\ssl_rsa.c, xrefs: 00007FFD9390B776, 00007FFD9390B840, 00007FFD9390B873, 00007FFD9390B8BC, 00007FFD9390B8FE, 00007FFD9390B949, 00007FFD9390B990, 00007FFD9390B9F3, 00007FFD9390BA3D

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$L_sk_numY_missing_parameters$L_sk_valueX509_get_pubkeyY_copy_parametersY_free
String ID: ..\s\ssl\ssl_rsa.c$ssl_set_cert_and_key
API String ID: 1144767644-2212061476
Opcode ID: 718aa228bd25fbf1d3cfbf5b674043b17c9deff214c523a0100d0522540fc82e
Instruction ID: 49da81d11eb134589f93fe6011056b37b664bfee845838d5d0cd214c186f4cc4
Opcode Fuzzy Hash: 718aa228bd25fbf1d3cfbf5b674043b17c9deff214c523a0100d0522540fc82e
Instruction Fuzzy Hash: 89B14C29B1864662EA74EBE1D4717BA2398EF94B84F500032ED4E73BD6DE3CE545CB01

Function 00007FFD938E1846 Relevance: 77.4, APIs: 42, Strings: 2, Instructions: 435COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFD9395AA0E
ERR_new.LIBCRYPTO-3 ref: 00007FFD9395AA1F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395AA37
X509_new_ex.LIBCRYPTO-3 ref: 00007FFD9395ABAF
d2i_X509.LIBCRYPTO-3 ref: 00007FFD9395ABCC
X509_free.LIBCRYPTO-3 ref: 00007FFD9395AE62
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD9395AE71

Strings

tls_process_client_certificate, xrefs: 00007FFD9395AA24, 00007FFD9395ACF5, 00007FFD9395AD7B, 00007FFD9395ADC3, 00007FFD9395ADE8, 00007FFD9395AE1F, 00007FFD9395AE8C, 00007FFD9395AEB1, 00007FFD9395AED9, 00007FFD9395AEFC, 00007FFD9395AF69, 00007FFD9395AFA3, 00007FFD9395AFF3, 00007FFD9395B12A
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD9395AA30, 00007FFD9395ACBD, 00007FFD9395AD01, 00007FFD9395AD87, 00007FFD9395ADA7, 00007FFD9395ADCF, 00007FFD9395ADF4, 00007FFD9395AE2B, 00007FFD9395AE98, 00007FFD9395AEBD, 00007FFD9395AF08, 00007FFD9395AF75, 00007FFD9395AFAF, 00007FFD9395AFFF, 00007FFD9395B136

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pop_freeR_newR_set_debugX509X509_freeX509_new_exd2i_
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_client_certificate
API String ID: 3085087540-2403068147
Opcode ID: 0354b7188ed3375122ca9793ddc61aaa29afc51b746fbb843e8a4165e2b2472e
Instruction ID: 8772ff9d72b7cc512c601bfbd97bbc16edc0335ea60ecb3af4e1913516ff4fe4
Opcode Fuzzy Hash: 0354b7188ed3375122ca9793ddc61aaa29afc51b746fbb843e8a4165e2b2472e
Instruction Fuzzy Hash: 5512AA26B08742A4FB71EBE5D8603B927A9EF84B84F444036DD4E67696EF3CE584C701

Function 00007FFD938E111D Relevance: 73.8, APIs: 39, Strings: 3, Instructions: 286COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFD938F31A3
ERR_new.LIBCRYPTO-3 ref: 00007FFD938F31B0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938F31C6
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938F31D6
ERR_new.LIBCRYPTO-3 ref: 00007FFD938F3233
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938F324B
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938F325C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938F3271

Strings

ssl_cert_dup, xrefs: 00007FFD938F31B5, 00007FFD938F3238, 00007FFD938F33C0, 00007FFD938F3530
gfffffff, xrefs: 00007FFD938F31EE
..\s\ssl\ssl_cert.c, xrefs: 00007FFD938F319C, 00007FFD938F31BF, 00007FFD938F3244, 00007FFD938F3267, 00007FFD938F3310, 00007FFD938F336E, 00007FFD938F33CC, 00007FFD938F343E, 00007FFD938F346C, 00007FFD938F3485, 00007FFD938F349E, 00007FFD938F34DB, 00007FFD938F34FF, 00007FFD938F3558, 00007FFD938F35C0, 00007FFD938F36A5

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_freeO_zalloc
String ID: ..\s\ssl\ssl_cert.c$gfffffff$ssl_cert_dup
API String ID: 1191937791-1697153846
Opcode ID: e048c4f90e9b58322efc39cd4b2d5113965c750834da7b20b8851709e95ac7b8
Instruction ID: 2b2c343a0045390486f4b4309e17e6b768a7af150fbb5b1915c639cd310bc47e
Opcode Fuzzy Hash: e048c4f90e9b58322efc39cd4b2d5113965c750834da7b20b8851709e95ac7b8
Instruction Fuzzy Hash: A9D18B75B09B42A2EB68DBA5E4A03F963A8FB44B84F400035DE5D67791DF3DE5A0C740

Function 00007FFD938E1646 Relevance: 72.1, APIs: 39, Strings: 2, Instructions: 334COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?), ref: 00007FFD93950AA3
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?), ref: 00007FFD93950AB5
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?), ref: 00007FFD93950ACD
X509_get0_pubkey.LIBCRYPTO-3(?,?,?,?,?,?,?,?), ref: 00007FFD93950B03
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?), ref: 00007FFD93950B10
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFD93950B28
BIO_free.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFD93950F86
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD93950F99
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93950FAE

Strings

tls_process_cert_verify, xrefs: 00007FFD93950ABA, 00007FFD93950B1A, 00007FFD93950B51, 00007FFD93950BF6, 00007FFD93950C2D, 00007FFD93950D5F, 00007FFD93950DC1, 00007FFD93950E9E, 00007FFD93950F4E
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93950AC6, 00007FFD93950B21, 00007FFD93950B5D, 00007FFD93950C02, 00007FFD93950C39, 00007FFD93950D66, 00007FFD93950DA5, 00007FFD93950DCD, 00007FFD93950EA5, 00007FFD93950F55, 00007FFD93950FA4

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeR_newR_set_debug$X509_get0_pubkeyX_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c$tls_process_cert_verify
API String ID: 3996869770-4103244874
Opcode ID: 66300fe5e646592a600a1c3d30a2e16b2af59001e27b2c7f76db3dc982a12af8
Instruction ID: a4979ed93597a47c976d6788d6a9fd5d1c1b6c74f2f0fea749dbccb52f7672a4
Opcode Fuzzy Hash: 66300fe5e646592a600a1c3d30a2e16b2af59001e27b2c7f76db3dc982a12af8
Instruction Fuzzy Hash: 0FE17D65B09782A1FB74ABD1D8717BA2398AF82B84F504032ED4D67796DF3CE5818701

Function 00007FFD938E116D Relevance: 68.6, APIs: 34, Strings: 5, Instructions: 379COMMON

Download Yara Rule

APIs

EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFD9393016A
ERR_new.LIBCRYPTO-3 ref: 00007FFD93930179
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93930191
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD93930254
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FFD9393026E
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FFD93930289
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FFD93930315
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393031E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93930336
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFD93930768
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFD9393077A
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93930782
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD9393078A

Strings

tls_psk_do_binder, xrefs: 00007FFD9393017E, 00007FFD93930323, 00007FFD9393038B, 00007FFD9393047D, 00007FFD939304B9, 00007FFD9393055E, 00007FFD93930668, 00007FFD9393069F, 00007FFD939306D3, 00007FFD9393070C
..\s\ssl\statem\extensions.c, xrefs: 00007FFD9393018A, 00007FFD9393032F, 00007FFD93930397, 00007FFD93930489, 00007FFD939304C5, 00007FFD9393056A, 00007FFD93930674, 00007FFD939306AB, 00007FFD939306DF, 00007FFD93930718
ext binder, xrefs: 00007FFD93930209
res binder, xrefs: 00007FFD93930202
HMAC, xrefs: 00007FFD93930534

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: Digest$Init_exL_cleanseR_newR_set_debug$D_get_sizeFinal_exX_freeX_newY_free
String ID: ..\s\ssl\statem\extensions.c$HMAC$ext binder$res binder$tls_psk_do_binder
API String ID: 1272419997-82630564
Opcode ID: b83220438b9ab0b683d3643b4e119f6c321eee854895ec546971faa3510bc489
Instruction ID: 69d0c52bf0d2af9eed5f7a1ef51b63b63effb074fb3f78b1ff7d8fbd0b77e874
Opcode Fuzzy Hash: b83220438b9ab0b683d3643b4e119f6c321eee854895ec546971faa3510bc489
Instruction Fuzzy Hash: A5F18066B0C782A1E778A7E1E8657EE6399BB85780F400031DE4E67B96DF7CE144CB40

Function 00007FFD938E26DF Relevance: 68.5, APIs: 35, Strings: 4, Instructions: 257COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3 ref: 00007FFD9390A147
BIO_new.LIBCRYPTO-3 ref: 00007FFD9390A14F
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390A15C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390A174
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD9390A192
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390A19B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390A1B3
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390A47E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390A496
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9390A4A7
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390A4BD
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390A4D3
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390A4E9
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390A4FF
BIO_free.LIBCRYPTO-3 ref: 00007FFD9390A507

Strings

SERVERINFO FOR , xrefs: 00007FFD9390A225
..\s\ssl\ssl_rsa.c, xrefs: 00007FFD9390A16D, 00007FFD9390A1AC, 00007FFD9390A26A, 00007FFD9390A2D6, 00007FFD9390A331, 00007FFD9390A34A, 00007FFD9390A364, 00007FFD9390A3E1, 00007FFD9390A417, 00007FFD9390A43B, 00007FFD9390A46B, 00007FFD9390A48F, 00007FFD9390A4B0, 00007FFD9390A4C6, 00007FFD9390A4DC, 00007FFD9390A4F2
SERVERINFOV2 FOR , xrefs: 00007FFD9390A28D
SSL_CTX_use_serverinfo_file, xrefs: 00007FFD9390A161, 00007FFD9390A1A0, 00007FFD9390A263, 00007FFD9390A3D5, 00007FFD9390A40B, 00007FFD9390A434, 00007FFD9390A45F, 00007FFD9390A483

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$R_newR_set_debug$O_ctrlO_newO_s_fileR_set_error
String ID: ..\s\ssl\ssl_rsa.c$SERVERINFO FOR $SERVERINFOV2 FOR $SSL_CTX_use_serverinfo_file
API String ID: 1122662597-2528746747
Opcode ID: 4e7bc5c39135565d6fded332fafe28efe5aab522e1aae3369110f26241436f3b
Instruction ID: 43d1053b7acec8d71e6810a8a0a9dc09472c2ac71b23910289410c8a454ac996
Opcode Fuzzy Hash: 4e7bc5c39135565d6fded332fafe28efe5aab522e1aae3369110f26241436f3b
Instruction Fuzzy Hash: BBB1B169B18642A5FB309BE1D8603FD23A9EF40794F504032ED4D67A9ADE3CE685C781

Function 00007FFD93900380 Relevance: 66.7, APIs: 37, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

X509_VERIFY_PARAM_free.LIBCRYPTO-3 ref: 00007FFD939003B7

Part of subcall function 00007FFD93905A60: OPENSSL_sk_pop_free.LIBCRYPTO-3(00000000,00007FFD938FFE08), ref: 00007FFD93905A81
Part of subcall function 00007FFD93905A60: OPENSSL_sk_pop_free.LIBCRYPTO-3(00000000,00007FFD938FFE08), ref: 00007FFD93905A97
Part of subcall function 00007FFD93905A60: X509_free.LIBCRYPTO-3(00000000,00007FFD938FFE08), ref: 00007FFD93905AA4

CRYPTO_free_ex_data.LIBCRYPTO-3 ref: 00007FFD939003D4
BIO_pop.LIBCRYPTO-3 ref: 00007FFD939003F0
BIO_free.LIBCRYPTO-3 ref: 00007FFD939003FD
BIO_free_all.LIBCRYPTO-3 ref: 00007FFD9390040E
BIO_free_all.LIBCRYPTO-3 ref: 00007FFD9390041F
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FFD93900433
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD9390043F
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD9390044B
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD93900457
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD93900463
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939004A6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939004CB
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939004E4
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93900509
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93900522
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390053B
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93900554
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD93900567
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD9390057A
SCT_LIST_free.LIBCRYPTO-3 ref: 00007FFD93900586
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390059F
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939005B8
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939005D1
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939005EA
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390060F
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93900628
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93900641
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD9390064D
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD93900660
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD93900673
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD93900686
ASYNC_WAIT_CTX_free.LIBCRYPTO-3 ref: 00007FFD939006B5
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939006CE
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FFD939006DA
CRYPTO_THREAD_lock_free.LIBCRYPTO-3 ref: 00007FFD939006E6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939006FB

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD93900499, 00007FFD939004BE, 00007FFD939004D7, 00007FFD939004FC, 00007FFD93900515, 00007FFD9390052E, 00007FFD93900547, 00007FFD93900592, 00007FFD939005AB, 00007FFD939005C4, 00007FFD939005DD, 00007FFD93900602, 00007FFD9390061B, 00007FFD93900634, 00007FFD939006C1, 00007FFD939006F1

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$L_sk_pop_free$L_sk_free$M_freeO_free_allX_free$D_lock_freeO_free_ex_dataO_popT_freeX509_X509_free
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1751156600-1080266419
Opcode ID: 50e2369ae7b8ff1e3a55b415751e92586b5c61a2d93558a160ece9789df705b2
Instruction ID: f0b5d7c9ab12ca3eafab3853998fc31cf54d64cb973140f3e793664cf6b87e1e
Opcode Fuzzy Hash: 50e2369ae7b8ff1e3a55b415751e92586b5c61a2d93558a160ece9789df705b2
Instruction Fuzzy Hash: 27912469B15A4760EB20FFE5D8B17B92325FF80F88F041032DE0E6B69ADE6CD1858751

Function 00007FFD939526E0 Relevance: 61.7, APIs: 31, Strings: 4, Instructions: 409COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3(?,?,?,?,00000000,?,?,?,00007FFD93956186), ref: 00007FFD9395276E
ERR_new.LIBCRYPTO-3(?,?,?,?,00000000,?,?,?,00007FFD93956186), ref: 00007FFD9395277C
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00000000,?,?,?,00007FFD93956186), ref: 00007FFD93952794
EVP_CIPHER_CTX_new.LIBCRYPTO-3(?,?,?,?,00000000,?,?,?,00007FFD93956186), ref: 00007FFD939527A4
ERR_new.LIBCRYPTO-3(?,?,?,?,00000000,?,?,?,00007FFD93956186), ref: 00007FFD939527E7
ERR_new.LIBCRYPTO-3(?,?,?,?,00000000,?,?,?,00007FFD93956186), ref: 00007FFD93952D30
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00000000,?,?,?,00007FFD93956186), ref: 00007FFD93952D48
CRYPTO_free.LIBCRYPTO-3(?,?,?,?,00000000,?,?,?,00007FFD93956186), ref: 00007FFD93952D73
EVP_CIPHER_CTX_free.LIBCRYPTO-3(?,?,?,?,00000000,?,?,?,00007FFD93956186), ref: 00007FFD93952D7B

Strings

SHA256, xrefs: 00007FFD93952953
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93952761, 00007FFD9395278D, 00007FFD93952866, 00007FFD93952C02, 00007FFD93952CAE, 00007FFD93952CF6, 00007FFD93952D41, 00007FFD93952D66
AES-256-CBC, xrefs: 00007FFD939528C0
construct_stateless_ticket, xrefs: 00007FFD93952786, 00007FFD9395285A, 00007FFD93952BF6, 00007FFD93952CEA, 00007FFD93952D3A

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$R_set_debug$O_freeO_mallocX_freeX_new
String ID: ..\s\ssl\statem\statem_srvr.c$AES-256-CBC$SHA256$construct_stateless_ticket
API String ID: 1754044936-1960200554
Opcode ID: 026c625fc48da80e0d9c934c4d15f43a8f4cba83a72d5efe84489ffc2d3e644b
Instruction ID: c8b715ad7c2b9bc16661a5ecfec35b96cae9717e35c8b0df14be644f6068de6a
Opcode Fuzzy Hash: 026c625fc48da80e0d9c934c4d15f43a8f4cba83a72d5efe84489ffc2d3e644b
Instruction Fuzzy Hash: CB029D66B0C742A5FB34ABE2D4707BD23A9AF44B88F404031DD4E77A96DE2DE586C740

Function 00007FFD938E162C Relevance: 58.0, APIs: 31, Strings: 2, Instructions: 245COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD9394F8B9
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394F8C6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394F8DE
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394F935
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394FB94
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394FBA0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394FBB8
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9394FBE2
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD9394FBEA

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD9394F8D7, 00007FFD9394F99D, 00007FFD9394FA4A, 00007FFD9394FACD, 00007FFD9394FB67, 00007FFD9394FBB1, 00007FFD9394FBD8
tls_construct_cert_verify, xrefs: 00007FFD9394F8CB, 00007FFD9394F996, 00007FFD9394FBAA

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$R_set_debug$O_freeX_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c$tls_construct_cert_verify
API String ID: 3285935519-2275373907
Opcode ID: fa070d2f81ccd89c61bee42e883de4a69c782245a686f86bc9d834ee74e3a6c5
Instruction ID: 422a0daea5ff7dcaed7171ade42e269922f96b409cbd6558935e1d3162d836a1
Opcode Fuzzy Hash: fa070d2f81ccd89c61bee42e883de4a69c782245a686f86bc9d834ee74e3a6c5
Instruction Fuzzy Hash: 1BA19265B0CB5361F670ABD2D8357BA6398EF86B80F444032ED4E67B96DE3CE5418701

Function 00007FFD938F43A0 Relevance: 57.9, APIs: 29, Strings: 4, Instructions: 178COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD938F43CE
X509_STORE_CTX_new_ex.LIBCRYPTO-3 ref: 00007FFD938F4414
ERR_new.LIBCRYPTO-3 ref: 00007FFD938F4421
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938F4439
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938F4449
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD938F446D
X509_STORE_CTX_init.LIBCRYPTO-3 ref: 00007FFD938F447E
ERR_new.LIBCRYPTO-3 ref: 00007FFD938F4487
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938F449F
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938F44B0
X509_STORE_CTX_free.LIBCRYPTO-3 ref: 00007FFD938F44B8
X509_STORE_CTX_set_flags.LIBCRYPTO-3 ref: 00007FFD938F44F1
CRYPTO_THREAD_run_once.LIBCRYPTO-3 ref: 00007FFD938F4504
X509_STORE_CTX_set_ex_data.LIBCRYPTO-3 ref: 00007FFD938F452A
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD938F454A
X509_STORE_CTX_set0_dane.LIBCRYPTO-3 ref: 00007FFD938F4559
X509_STORE_CTX_set_default.LIBCRYPTO-3 ref: 00007FFD938F4577
X509_VERIFY_PARAM_set1.LIBCRYPTO-3 ref: 00007FFD938F4586
X509_STORE_CTX_set_verify_cb.LIBCRYPTO-3 ref: 00007FFD938F459A
X509_verify_cert.LIBCRYPTO-3 ref: 00007FFD938F45C2
X509_STORE_CTX_get_error.LIBCRYPTO-3 ref: 00007FFD938F45D2
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD938F45EB
X509_STORE_CTX_get0_chain.LIBCRYPTO-3 ref: 00007FFD938F45FA
X509_STORE_CTX_get1_chain.LIBCRYPTO-3 ref: 00007FFD938F4607
ERR_new.LIBCRYPTO-3 ref: 00007FFD938F4618
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938F4630
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938F4641
X509_VERIFY_PARAM_move_peername.LIBCRYPTO-3 ref: 00007FFD938F4653
X509_STORE_CTX_free.LIBCRYPTO-3 ref: 00007FFD938F465B

Strings

ssl_server, xrefs: 00007FFD938F4569
ssl_verify_cert_chain, xrefs: 00007FFD938F4426, 00007FFD938F448C, 00007FFD938F461D
ssl_client, xrefs: 00007FFD938F4562
..\s\ssl\ssl_cert.c, xrefs: 00007FFD938F4432, 00007FFD938F4498, 00007FFD938F4629

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: X509_$R_newR_set_debugR_set_error$L_sk_numX_free$D_run_onceL_sk_pop_freeL_sk_valueM_move_peernameM_set1X509_verify_certX_get0_chainX_get1_chainX_get_errorX_initX_new_exX_set0_daneX_set_defaultX_set_ex_dataX_set_flagsX_set_verify_cb
String ID: ..\s\ssl\ssl_cert.c$ssl_client$ssl_server$ssl_verify_cert_chain
API String ID: 374146265-1087352319
Opcode ID: 67301769716e3a631a9ecf5bd14671fd1b2cbb774a5bb158fdea402df5d14953
Instruction ID: b8d57f17b35b7fcc053a6d84cbf7c22f3fb96a02924d944c83d68da8513208b1
Opcode Fuzzy Hash: 67301769716e3a631a9ecf5bd14671fd1b2cbb774a5bb158fdea402df5d14953
Instruction Fuzzy Hash: 7571D065B0974265FA60EBE295707BA2399AF85BC4F044032DD0E67796DF2CE8818B81

Function 00007FFD93944110 Relevance: 52.7, APIs: 25, Strings: 5, Instructions: 198COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,00007FFD93944EA5), ref: 00007FFD93944145
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,00007FFD93944EA5), ref: 00007FFD9394415D
X509_get0_pubkey.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,00007FFD93944EA5), ref: 00007FFD93944185
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,00007FFD93944EA5), ref: 00007FFD939441A0
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,00007FFD93944EA5), ref: 00007FFD939441B8

Strings

0, xrefs: 00007FFD939443C6
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93944156, 00007FFD939441B1, 00007FFD939441EC, 00007FFD93944216, 00007FFD9394427F, 00007FFD939442C0, 00007FFD939443E4, 00007FFD93944409, 00007FFD93944430
tls_construct_cke_rsa, xrefs: 00007FFD9394414A, 00007FFD939441A5, 00007FFD9394420A, 00007FFD93944273, 00007FFD939442B9, 00007FFD939443D8, 00007FFD939443FD
0, xrefs: 00007FFD939443A8
RSA, xrefs: 00007FFD9394418A

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$X509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$0$0$RSA$tls_construct_cke_rsa
API String ID: 2988517565-1370622440
Opcode ID: 7a1bc44dbc0c44bbc94590b7c3d382cd6c831207d2be373f0034306c18b80391
Instruction ID: a7c27411a818d3069be217f8010a8a4154340a923d109f676583d475dda98951
Opcode Fuzzy Hash: 7a1bc44dbc0c44bbc94590b7c3d382cd6c831207d2be373f0034306c18b80391
Instruction Fuzzy Hash: 57817D65B1C742A1F734ABE1E9357BA2398AF95B84F440032DD4E67A96DF3CE141CB40

Function 00007FFD9395A2C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 213COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,00007FFD9395BC68), ref: 00007FFD9395A2FD
ERR_set_debug.LIBCRYPTO-3(?,?,?,00007FFD9395BC68), ref: 00007FFD9395A315
ERR_new.LIBCRYPTO-3(?,?,?,00007FFD9395BC68), ref: 00007FFD9395A3A7
ERR_set_debug.LIBCRYPTO-3(?,?,?,00007FFD9395BC68), ref: 00007FFD9395A3BF

Strings

tls-client-version, xrefs: 00007FFD9395A4CD
0, xrefs: 00007FFD9395A5B0
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD9395A30E, 00007FFD9395A3B8, 00007FFD9395A3F3, 00007FFD9395A426, 00007FFD9395A47F, 00007FFD9395A60C, 00007FFD9395A632
tls-negotiated-version, xrefs: 00007FFD9395A518
tls_process_cke_rsa, xrefs: 00007FFD9395A302, 00007FFD9395A3AC, 00007FFD9395A41A, 00007FFD9395A473, 00007FFD9395A605

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$0$tls-client-version$tls-negotiated-version$tls_process_cke_rsa
API String ID: 193678381-3332223380
Opcode ID: 5bb5ccd3e4bbc846f2449639d6ce574c27e8f6a11b89b12c899185f0fbf4fa0e
Instruction ID: b28b03ec830ca2fac68fe643a752d42b3468ec64794fded61f58c0980bb1ab06
Opcode Fuzzy Hash: 5bb5ccd3e4bbc846f2449639d6ce574c27e8f6a11b89b12c899185f0fbf4fa0e
Instruction Fuzzy Hash: FEA1C066B18B82A5E331ABE1D4217FA6368FF95784F404131DE4E23696EF3CE581CB00

Function 00007FFD938E13D9 Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 256COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFD93947AFA
ERR_new.LIBCRYPTO-3 ref: 00007FFD93947B12
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93947B2A
X509_new_ex.LIBCRYPTO-3 ref: 00007FFD93947C2D
d2i_X509.LIBCRYPTO-3 ref: 00007FFD93947C56
X509_free.LIBCRYPTO-3 ref: 00007FFD93947F26
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD93947F40

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93947B23, 00007FFD93947D7D, 00007FFD93947DD7, 00007FFD93947DFF, 00007FFD93947E36, 00007FFD93947E5E, 00007FFD93947E8B, 00007FFD93947EBD, 00007FFD93947EFC
tls_process_server_certificate, xrefs: 00007FFD93947B1C, 00007FFD93947DF3, 00007FFD93947E2F, 00007FFD93947E52, 00007FFD93947E7F, 00007FFD93947EB1, 00007FFD93947EF0

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pop_freeR_newR_set_debugX509X509_freeX509_new_exd2i_
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_server_certificate
API String ID: 3085087540-2730446810
Opcode ID: 1083cbb614af8eb737620d1e5047b46802b70fc1952205c68d298ce85ef246d1
Instruction ID: 09fd97f6597b6f48dba7f2cbbfa354a3594b0904a5170ad7187532984a6296f2
Opcode Fuzzy Hash: 1083cbb614af8eb737620d1e5047b46802b70fc1952205c68d298ce85ef246d1
Instruction Fuzzy Hash: 9EC1E362B18B96A1E7309BE5D4643FE2399EB80B84F104132DA6D676D6DF3CE481CB40

Function 00007FFD93943420 Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 207COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,00007FFD9394504D), ref: 00007FFD93943470
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00007FFD9394504D), ref: 00007FFD93943488
X509_get0_pubkey.LIBCRYPTO-3(?,?,?,?,00007FFD9394504D), ref: 00007FFD939434BF
EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3(?,?,?,?,00007FFD9394504D), ref: 00007FFD939434D8
ERR_new.LIBCRYPTO-3(?,?,?,?,00007FFD9394504D), ref: 00007FFD939434E5
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00007FFD9394504D), ref: 00007FFD939434FD

Strings

, xrefs: 00007FFD9394366E
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93943481, 00007FFD939434F6, 00007FFD9394352C, 00007FFD93943732, 00007FFD9394375E
tls_construct_cke_gost, xrefs: 00007FFD93943475, 00007FFD939434EA, 00007FFD93943729

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$X509_get0_pubkeyX_new_from_pkey
String ID: $..\s\ssl\statem\statem_clnt.c$tls_construct_cke_gost
API String ID: 3869628303-1144584530
Opcode ID: 8355a11617973a3a9c271e8226d5d584887406d8c4f71a30efb2c1e149aa921b
Instruction ID: ac5f659d7797c82a0f66879786fe1ff7e08ca354f6fa6c328a5eaf47d1a64154
Opcode Fuzzy Hash: 8355a11617973a3a9c271e8226d5d584887406d8c4f71a30efb2c1e149aa921b
Instruction Fuzzy Hash: 09919D76B1879261FB74ABE2D5A47FA2398BF85B84F400031DD4E6B782DF2CE5508B40

Function 00007FFD93929370 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939293DD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939293F5
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFD93929429
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFD93929436
ERR_new.LIBCRYPTO-3 ref: 00007FFD93929440
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93929458

Strings

..\s\ssl\record\ssl3_record.c, xrefs: 00007FFD939293EE, 00007FFD93929451, 00007FFD939294B8, 00007FFD9392958E, 00007FFD93929673, 00007FFD939296B7, 00007FFD93929714, 00007FFD9392975C
dtls1_process_record, xrefs: 00007FFD939293E2, 00007FFD93929445, 00007FFD939294AC, 00007FFD93929582, 00007FFD93929667, 00007FFD939296AB, 00007FFD93929708

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$D_get_sizeX_get0_md
String ID: ..\s\ssl\record\ssl3_record.c$dtls1_process_record
API String ID: 1548276727-2476007939
Opcode ID: 178ddcd360d4b3a12c89ccc30972a41ae4475cc8a7a2d8035e9ef9ed616f317d
Instruction ID: 1189dc48c19d09c08c65076824ccded3602e5f628e7dd042e72093f1d7d61a11
Opcode Fuzzy Hash: 178ddcd360d4b3a12c89ccc30972a41ae4475cc8a7a2d8035e9ef9ed616f317d
Instruction Fuzzy Hash: 1DB17F25B09A42A1FBB4ABE5E5207FA2399FF84B84F444032DE4E67695DF3CE564C700

Function 00007FFD938E230B Relevance: 42.4, APIs: 20, Strings: 4, Instructions: 388COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939474BF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939474D7
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFD93947532
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93947564
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD9394758D
ERR_new.LIBCRYPTO-3 ref: 00007FFD939475AE
ERR_new.LIBCRYPTO-3 ref: 00007FFD939475CC
EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FFD9394770E
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394772B
ERR_new.LIBCRYPTO-3 ref: 00007FFD939478BA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939478D2
EVP_MD_free.LIBCRYPTO-3 ref: 00007FFD939478EE
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93947908

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD939474D0, 00007FFD93947550, 00007FFD9394756C, 00007FFD9394777A, 00007FFD93947811, 00007FFD93947881, 00007FFD939478CB, 00007FFD939478FB
resumption, xrefs: 00007FFD9394783A
SHA2-256, xrefs: 00007FFD939476FD
tls_process_new_session_ticket, xrefs: 00007FFD939474C9, 00007FFD9394776E, 00007FFD93947805, 00007FFD939478C4

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$O_freeR_set_debug$D_fetchD_freeO_malloc_time64
String ID: ..\s\ssl\statem\statem_clnt.c$SHA2-256$resumption$tls_process_new_session_ticket
API String ID: 4294151624-1635961163
Opcode ID: c7af424069aa15eee3a1ff15ccabd709f4a38e17076db407352773dc70be74d1
Instruction ID: dacfe7b9b6378fce51b5aa39b4980b4172928aabb70e4e069017d7ec678a9f97
Opcode Fuzzy Hash: c7af424069aa15eee3a1ff15ccabd709f4a38e17076db407352773dc70be74d1
Instruction Fuzzy Hash: 91021472B08B8691E730DB95E4A43BD77AAEB84B84F048136DA9D67795DF3CE181C700

Function 00007FFD938E15E6 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93909E02
ERR_new.LIBCRYPTO-3 ref: 00007FFD93909E0F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93909E27
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93909E37
memcpy.VCRUNTIME140 ref: 00007FFD93909E68
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93909E93
ERR_new.LIBCRYPTO-3 ref: 00007FFD93909EB0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93909EC8
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93909ED9
ERR_new.LIBCRYPTO-3 ref: 00007FFD93909EF4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93909F0C
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93909F1D
ERR_new.LIBCRYPTO-3 ref: 00007FFD93909F4A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93909F62
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93909F73
memcpy.VCRUNTIME140 ref: 00007FFD93909FA1
ERR_new.LIBCRYPTO-3 ref: 00007FFD93909FC8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93909FE0
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93909FF1
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390A007
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390A01F
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9390A030

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFD93909DF7, 00007FFD93909E20, 00007FFD93909E87, 00007FFD93909EC1, 00007FFD93909F05, 00007FFD93909F2D, 00007FFD93909F5B, 00007FFD93909FD9, 00007FFD9390A018
SSL_CTX_use_serverinfo_ex, xrefs: 00007FFD93909E14, 00007FFD93909EB5, 00007FFD93909EF9, 00007FFD93909F4F, 00007FFD93909FCD, 00007FFD9390A00C

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$memcpy$O_freeO_malloc
String ID: ..\s\ssl\ssl_rsa.c$SSL_CTX_use_serverinfo_ex
API String ID: 2045424659-2326540444
Opcode ID: 293f96c77ec9b3ea1394ded9c631bc52f7003473748ea78ecdfc371e71dabf1d
Instruction ID: 16162fe0f3369eb13d8e16f1b2d99d0579e5a3cb3e15d93f0c6a5f8e7521ac1c
Opcode Fuzzy Hash: 293f96c77ec9b3ea1394ded9c631bc52f7003473748ea78ecdfc371e71dabf1d
Instruction Fuzzy Hash: BB617D29B18642A1E670DBE4D9317FA2359EF94780F904031ED4E637E6DE2CE981C740

Function 00007FFD93959790 Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD9395981A
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD93959827
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD9395983F
EVP_PKEY_decrypt_init.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD93959862
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD9395986B
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD93959883
X509_get0_pubkey.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD939598BA
ERR_clear_error.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD939598D3
ASN1_item_d2i.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD939598F2
ASN1_TYPE_get.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD9395990F
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD93959945
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD9395995D
EVP_PKEY_decrypt.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD9395998C
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD93959995
EVP_PKEY_CTX_ctrl.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD939599D5
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD93959A13
EVP_PKEY_CTX_free.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD93959A31
ASN1_item_free.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9395BCB6), ref: 00007FFD93959A40

Strings

, xrefs: 00007FFD939597C0
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93959838, 00007FFD9395987C, 00007FFD93959956, 00007FFD93959A0C
tls_process_cke_gost, xrefs: 00007FFD9395982C, 00007FFD93959870, 00007FFD9395994F, 00007FFD93959A05

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$E_getN1_item_d2iN1_item_freeR_clear_errorX509_get0_pubkeyX_ctrlX_freeX_new_from_pkeyY_decryptY_decrypt_init
String ID: $..\s\ssl\statem\statem_srvr.c$tls_process_cke_gost
API String ID: 46435683-2809538378
Opcode ID: e18635b5dd13bb857b5ee75ac4588eab4e323f20d50603a590beb7fe783099d7
Instruction ID: 1651229737529d5477fefb30e231fc3944782261567faa9c7147fe82dc94bbe4
Opcode Fuzzy Hash: e18635b5dd13bb857b5ee75ac4588eab4e323f20d50603a590beb7fe783099d7
Instruction Fuzzy Hash: 3F717F65B08B42A5FB30ABEAE4717B92359AF85B84F544031DE4E27796DF2CE4818700

Function 00007FFD939021C0 Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939021D7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939021EF
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD939021FF
ERR_new.LIBCRYPTO-3 ref: 00007FFD93902213
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390222B
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9390223C

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD939021E8, 00007FFD93902224, 00007FFD9390224E, 00007FFD93902293, 00007FFD939022BF, 00007FFD93902567, 00007FFD939025B2, 00007FFD9390260B
SSL_new, xrefs: 00007FFD939021DC, 00007FFD93902218, 00007FFD939022B3

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_new
API String ID: 1552677711-1278568459
Opcode ID: 70ac47f4399532c403a3cd33b4663962d4bed4d87ea2d6c605935e0e27f9bf3b
Instruction ID: 031311be34b015ae4c8c4648ebe21340f55381b6f24ca6b0750069a4e3748cf0
Opcode Fuzzy Hash: 70ac47f4399532c403a3cd33b4663962d4bed4d87ea2d6c605935e0e27f9bf3b
Instruction Fuzzy Hash: CFE14736716B86A6EB98DFA8D5907E873A8FB08B84F080135DF9C57755DF38E0A08710

Function 00007FFD938E144C Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD939513C1
ERR_new.LIBCRYPTO-3 ref: 00007FFD939513D2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939513EA
ERR_new.LIBCRYPTO-3 ref: 00007FFD9395141F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93951437
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD93951458
ERR_new.LIBCRYPTO-3 ref: 00007FFD9395149C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939514B4
ERR_new.LIBCRYPTO-3 ref: 00007FFD939514FF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93951517

Strings

tls13_save_handshake_digest_for_pha, xrefs: 00007FFD939513D7, 00007FFD93951424
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD939513E3, 00007FFD93951430, 00007FFD939514AD, 00007FFD93951510, 00007FFD9395155C, 00007FFD939515A9, 00007FFD939515E6
tls_process_finished, xrefs: 00007FFD939514A1, 00007FFD93951504, 00007FFD93951550, 00007FFD9395159D, 00007FFD939515DA

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$X_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c$tls13_save_handshake_digest_for_pha$tls_process_finished
API String ID: 1676177304-1286925996
Opcode ID: 70252e26435c598d36948de3f9f42d7969caea64793bb3b708012f7c0e9b5c89
Instruction ID: 1996e105e09e0b9fce02f4b38c344ebc5f57387ca15d7d02e85e821faaa12e47
Opcode Fuzzy Hash: 70252e26435c598d36948de3f9f42d7969caea64793bb3b708012f7c0e9b5c89
Instruction Fuzzy Hash: 10A14D25B09742A1EB70EFE1D4707B92398EF84B88F545036DE4E67695DF2CE581C740

Function 00007FFD938E25EF Relevance: 36.9, APIs: 12, Strings: 9, Instructions: 146COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93912412
ERR_new.LIBCRYPTO-3 ref: 00007FFD9391241F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93912437
memcpy.VCRUNTIME140 ref: 00007FFD9391244F
memcpy.VCRUNTIME140 ref: 00007FFD939124C0
memcmp.VCRUNTIME140 ref: 00007FFD939124D5
memcmp.VCRUNTIME140 ref: 00007FFD939124F2
memcmp.VCRUNTIME140 ref: 00007FFD93912531
ERR_new.LIBCRYPTO-3 ref: 00007FFD939125C5
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939125DD
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD939125EE
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD93912608

Strings

n, xrefs: 00007FFD93912556
key expa, xrefs: 00007FFD9391253E
..\s\ssl\t1_enc.c, xrefs: 00007FFD93912408, 00007FFD93912430, 00007FFD939125D6, 00007FFD939125FB
master s, xrefs: 00007FFD939124FF
extended master secret, xrefs: 00007FFD93912527
tls1_export_keying_material, xrefs: 00007FFD93912424, 00007FFD939125CA
server finished, xrefs: 00007FFD939124E8
client finished, xrefs: 00007FFD939124CB
nsio, xrefs: 00007FFD9391254D

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: memcmp$R_newR_set_debugmemcpy$O_clear_freeO_mallocR_set_error
String ID: ..\s\ssl\t1_enc.c$client finished$extended master secret$key expa$master s$n$nsio$server finished$tls1_export_keying_material
API String ID: 2646480882-4292774120
Opcode ID: 1286166012c42b00a96a554d015e8feeac319495cec835ade4583d4d80e827a4
Instruction ID: 6ed53eec5dc43c7cf5bc4922ff1b87490c8f0365029d034ec29309d03905d8a4
Opcode Fuzzy Hash: 1286166012c42b00a96a554d015e8feeac319495cec835ade4583d4d80e827a4
Instruction Fuzzy Hash: 8E619262B08781A1E730DFD5A9603AA63A8FB587C8F548135DE8D23B9ADF3CD585C740

Function 00007FFD93922230 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939222D2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939222EA
BN_num_bits.LIBCRYPTO-3 ref: 00007FFD93922397
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD939223BB
ERR_new.LIBCRYPTO-3 ref: 00007FFD939223C8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939223E0
BN_clear_free.LIBCRYPTO-3 ref: 00007FFD93922459
BN_clear_free.LIBCRYPTO-3 ref: 00007FFD93922461
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD939224A8
ERR_new.LIBCRYPTO-3 ref: 00007FFD939224AF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939224C7
BN_clear_free.LIBCRYPTO-3 ref: 00007FFD939224E3
BN_clear_free.LIBCRYPTO-3 ref: 00007FFD939224EA
BN_clear_free.LIBCRYPTO-3 ref: 00007FFD939224F2

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFD939222E3, 00007FFD939223AB, 00007FFD939223D9, 00007FFD93922435, 00007FFD93922494, 00007FFD939224C0
srp_generate_client_master_secret, xrefs: 00007FFD939222D7, 00007FFD939223CD, 00007FFD93922429, 00007FFD939224B4

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: N_clear_free$R_newR_set_debug$N_num_bitsO_clear_freeO_malloc
String ID: ..\s\ssl\tls_srp.c$srp_generate_client_master_secret
API String ID: 1310426286-3880031085
Opcode ID: 447721e5ea76b885f34a0294fe4c24562583dade5680486d88c62bbd87b54b6e
Instruction ID: 47e43119bfd2ccfe021cb9ff6abbe9d33f1d452a701381c628d20aef2b9147a6
Opcode Fuzzy Hash: 447721e5ea76b885f34a0294fe4c24562583dade5680486d88c62bbd87b54b6e
Instruction Fuzzy Hash: 38617466B09B8261E774ABE2E9607F96398BB85BC4F404035DE4D67786DF3CE191C700

Function 00007FFD938E176C Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD9390F6FA
CRYPTO_THREAD_lock_new.LIBCRYPTO-3 ref: 00007FFD9390F7F6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390F817
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390F81F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390F837
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9390F848
X509_up_ref.LIBCRYPTO-3 ref: 00007FFD9390F896
X509_chain_up_ref.LIBCRYPTO-3 ref: 00007FFD9390F8B9
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD9390F8E7
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD9390F915
CRYPTO_dup_ex_data.LIBCRYPTO-3 ref: 00007FFD9390F93D
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD9390F963
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD9390F99C
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD9390F9E1
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD9390FA0F
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD9390FA44

Strings

ssl_session_dup, xrefs: 00007FFD9390F824
..\s\ssl\ssl_sess.c, xrefs: 00007FFD9390F6E8, 00007FFD9390F80D, 00007FFD9390F830, 00007FFD9390F8E0, 00007FFD9390F90E, 00007FFD9390F95C, 00007FFD9390F98F, 00007FFD9390F9D4, 00007FFD9390FA08, 00007FFD9390FA37

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_strdup$O_memdup$D_lock_newO_dup_ex_dataO_freeO_mallocR_newR_set_debugR_set_errorX509_chain_up_refX509_up_ref
String ID: ..\s\ssl\ssl_sess.c$ssl_session_dup
API String ID: 1347456398-2356865551
Opcode ID: c91e6a8d12510ecb13b80947944277ea1fb9b98c3fc597ebccf6540816cd0e10
Instruction ID: e50fb7f470fe2f8a4b8e1389d7fff50badcfbfb27eafca92fe8dc3e76885c8a5
Opcode Fuzzy Hash: c91e6a8d12510ecb13b80947944277ea1fb9b98c3fc597ebccf6540816cd0e10
Instruction Fuzzy Hash: A5918625B0AB86A2EB65DFA494A03FC235CFF45B44F085635DE4E27696DF38E294C310

Function 00007FFD938E136B Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9390E85D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390E875
CRYPTO_THREAD_read_lock.LIBCRYPTO-3 ref: 00007FFD9390E8E5
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFD9390E8F5
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390E8FA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390E912
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFD9390E979
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFD9390E985
memset.VCRUNTIME140 ref: 00007FFD9390E99A
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390E9C3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390E9DB
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390EA19
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390EA31

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFD9390E86E, 00007FFD9390E90B, 00007FFD9390E9D4, 00007FFD9390EA2A, 00007FFD9390EA64
ssl_generate_session_id, xrefs: 00007FFD9390E862, 00007FFD9390E8FF, 00007FFD9390E9C8, 00007FFD9390EA1E, 00007FFD9390EA58

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$D_unlock$D_read_lockmemset
String ID: ..\s\ssl\ssl_sess.c$ssl_generate_session_id
API String ID: 2442218550-3346574085
Opcode ID: 989af3b3d59cb0368f61ca77f129cdeb29dc6a1c3ddd44b3278c33da225025df
Instruction ID: e6854483ed47aefba92efb93c2d642f9b0ed58c57e7e7b5a0d7d609f616d979e
Opcode Fuzzy Hash: 989af3b3d59cb0368f61ca77f129cdeb29dc6a1c3ddd44b3278c33da225025df
Instruction Fuzzy Hash: 6E61C329F28A42A1F774EBA5E8647F923A8FF84784F440031DE4D63A96DF2DE5808740

Function 00007FFD938E2180 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 177COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939323B2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939323CA
ERR_new.LIBCRYPTO-3 ref: 00007FFD939323FF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93932417
EVP_PKEY_get1_encoded_public_key.LIBCRYPTO-3 ref: 00007FFD9393246A
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939324D5
ERR_new.LIBCRYPTO-3 ref: 00007FFD939324FC
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393251C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93932531
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93932555
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9393256C
ERR_new.LIBCRYPTO-3 ref: 00007FFD93932576
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393258E

Strings

add_key_share, xrefs: 00007FFD93932404, 00007FFD93932521
tls_construct_ctos_key_share, xrefs: 00007FFD939323B7, 00007FFD93932501, 00007FFD9393257B
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD939323C3, 00007FFD93932410, 00007FFD939324BA, 00007FFD9393252A, 00007FFD9393255F, 00007FFD93932587

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$R_set_debug$O_free$Y_freeY_get1_encoded_public_key
String ID: ..\s\ssl\statem\extensions_clnt.c$add_key_share$tls_construct_ctos_key_share
API String ID: 2910640537-2776458525
Opcode ID: 4865d4d5deb7a2acdb2f78b999820b8013f9469657d09b69bf8b184d77c852f9
Instruction ID: c9ed37849cdfd62a8e9667302f9706443644f3665eb1b7c0c6b142c9dc9bef3a
Opcode Fuzzy Hash: 4865d4d5deb7a2acdb2f78b999820b8013f9469657d09b69bf8b184d77c852f9
Instruction Fuzzy Hash: 7E718F61B0C78261EB78AB91E4647BA2398AF84BC0F540031EE8E67BD6DF3CE5408700

Function 00007FFD938EF7F0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD938EF827
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938EF83F
EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3 ref: 00007FFD938EF875
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD938EF8D9
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD938EF8F3
EVP_PKEY_encapsulate.LIBCRYPTO-3 ref: 00007FFD938EF91D
ERR_new.LIBCRYPTO-3 ref: 00007FFD938EF926
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938EF9B8
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD938EF9E7
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938EF9FC
EVP_PKEY_CTX_free.LIBCRYPTO-3 ref: 00007FFD938EFA04

Strings

ssl_encapsulate, xrefs: 00007FFD938EF82C, 00007FFD938EF980, 00007FFD938EF9AA
..\s\ssl\s3_lib.c, xrefs: 00007FFD938EF838, 00007FFD938EF8D2, 00007FFD938EF8E3, 00007FFD938EF98C, 00007FFD938EF9B1, 00007FFD938EF9D7, 00007FFD938EF9F2

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_mallocR_newR_set_debug$O_clear_freeO_freeX_freeX_new_from_pkeyY_encapsulate
String ID: ..\s\ssl\s3_lib.c$ssl_encapsulate
API String ID: 1298386825-1554727935
Opcode ID: 1779be5004fc6655a02527e1373e511c72f1684f09e346fefe886900125854f5
Instruction ID: c3bd41d6458289344c7b4a3749f556fde76338a663af0dacd606d7e1f3777941
Opcode Fuzzy Hash: 1779be5004fc6655a02527e1373e511c72f1684f09e346fefe886900125854f5
Instruction Fuzzy Hash: 6A51A325B09B42A1F734BBE6E8606BA6399FF85B84F404032ED8D27B95DE3DD541C740

Function 00007FFD938E2121 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD9390F1F7
CRYPTO_THREAD_read_lock.LIBCRYPTO-3 ref: 00007FFD9390F20B
OPENSSL_LH_retrieve.LIBCRYPTO-3 ref: 00007FFD9390F228
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFD9390F24A
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFD9390F262
memcmp.VCRUNTIME140 ref: 00007FFD9390F32B
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390F346
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390F35E
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFD9390F382
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390F3E4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390F3FC
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390F491
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390F4A9

Strings

ssl_get_prev_session, xrefs: 00007FFD9390F34B, 00007FFD9390F3E9, 00007FFD9390F496
..\s\ssl\ssl_sess.c, xrefs: 00007FFD9390F357, 00007FFD9390F3F5, 00007FFD9390F4A2

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$D_unlock$D_read_lockH_retrieve_time64memcmpmemcpy
String ID: ..\s\ssl\ssl_sess.c$ssl_get_prev_session
API String ID: 2856374240-1331951588
Opcode ID: 0352ad9fc4eb995808501633053fa83929032a4800353e971eb6e04da81094a5
Instruction ID: c8b5ef38a131a9e2aa39e75926101b2d1cb0085c3bb6a9d3dfc21e85aeb6c5fb
Opcode Fuzzy Hash: 0352ad9fc4eb995808501633053fa83929032a4800353e971eb6e04da81094a5
Instruction Fuzzy Hash: 96C19F3AB1968292E7B4AFA5D4647B93368FB86B88F044131DE4E67795CF3CE644C700

Function 00007FFD938E17E9 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93934752
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393476A
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939347FF
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93934813
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393482B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93934843

Strings

tls_parse_stoc_alpn, xrefs: 00007FFD93934757, 00007FFD93934835, 00007FFD9393495D
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93934763, 00007FFD939347F2, 00007FFD9393480A, 00007FFD9393483C, 00007FFD939348E2, 00007FFD93934964

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_malloc
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_parse_stoc_alpn
API String ID: 3068916411-3270594983
Opcode ID: 62731cddf9537b0aaf11cb1f3cec899e54faec6f444ceb808bf10051b318dc59
Instruction ID: 416c12b67081e3f89a58eaafbf72b1d999000598dc9a45d272f1bd4cc911dc10
Opcode Fuzzy Hash: 62731cddf9537b0aaf11cb1f3cec899e54faec6f444ceb808bf10051b318dc59
Instruction Fuzzy Hash: 2F51C4A1B0DB82A1EB749BD1D4603BE2398EB84B84F544035DE5E2B7D6DF7CE5918700

Function 00007FFD9390D0C0 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

CRYPTO_free_ex_data.LIBCRYPTO-3 ref: 00007FFD9390D0FF
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFD9390D10D
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFD9390D11E
X509_free.LIBCRYPTO-3 ref: 00007FFD9390D12A
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD9390D13D
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390D156
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390D16F
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390D188
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390D1A1
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390D1BA
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390D1D3
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390D1EC
CRYPTO_THREAD_lock_free.LIBCRYPTO-3 ref: 00007FFD9390D1F8
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD9390D211

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFD9390D149, 00007FFD9390D162, 00007FFD9390D17B, 00007FFD9390D194, 00007FFD9390D1AD, 00007FFD9390D1C6, 00007FFD9390D1DF, 00007FFD9390D203

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$L_cleanse$D_lock_freeL_sk_pop_freeO_clear_freeO_free_ex_dataX509_free
String ID: ..\s\ssl\ssl_sess.c
API String ID: 4155952050-2868363209
Opcode ID: 82691f811a331bd1f130281261cc35d788ecd773c836a68dec9266fb7c91e4e1
Instruction ID: 919ed8c1c9cbb62261e2484a90932c1e6317ed28ef8cee03b595722d37955ce7
Opcode Fuzzy Hash: 82691f811a331bd1f130281261cc35d788ecd773c836a68dec9266fb7c91e4e1
Instruction Fuzzy Hash: B3317069B05707A2EB21AFE6D8757B9131DFB85F84F444031EC0D6B6EADE2CE2858710

Function 00007FFD938F70B0 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 357stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD938F723A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD938F74BC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD938F74F4
ERR_new.LIBCRYPTO-3 ref: 00007FFD938F751C
ERR_new.LIBCRYPTO-3 ref: 00007FFD938F7528
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938F7540
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938F7551
ERR_new.LIBCRYPTO-3 ref: 00007FFD938F7595
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938F75AD
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938F75BE

Strings

STRENGTH, xrefs: 00007FFD938F74B2
..\s\ssl\ssl_ciph.c, xrefs: 00007FFD938F7539, 00007FFD938F75A6
SECLEVEL=, xrefs: 00007FFD938F74ED
ssl_cipher_process_rulestr, xrefs: 00007FFD938F7532, 00007FFD938F759A

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newstrncmp$R_set_debugR_set_error
String ID: ..\s\ssl\ssl_ciph.c$SECLEVEL=$STRENGTH$ssl_cipher_process_rulestr
API String ID: 1163294807-331183818
Opcode ID: 75b08b654c2f2e97f5e09b9c71eb3839d8696c64fca3119346ee776943bfacbe
Instruction ID: 9a5742111d0e1e3288efd391a8d5139adc52f840eb527b8b6304fbfc2789c4a9
Opcode Fuzzy Hash: 75b08b654c2f2e97f5e09b9c71eb3839d8696c64fca3119346ee776943bfacbe
Instruction Fuzzy Hash: 0FE18D72B0C68286F7748BA5A46077A7799FB847C4F505035FE8E63694DB3EEC418B80

Function 00007FFD9390D750 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD938E1087: ERR_new.LIBCRYPTO-3 ref: 00007FFD938FB75F
Part of subcall function 00007FFD938E1087: ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FB777
Part of subcall function 00007FFD938E1087: ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FB788

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFD9390D78B
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390D798
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390D7B0
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9390D7C0

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFD9390D77F, 00007FFD9390D7A9, 00007FFD9390D85E, 00007FFD9390D8AD
SSL_SESSION_new, xrefs: 00007FFD9390D79D, 00007FFD9390D852

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_zalloc
String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new
API String ID: 1179349375-402823876
Opcode ID: 14345e81860665dd88fc5b21882cf9813976ce1dd4121f2083c28ab1b41d5a00
Instruction ID: d51875ee2a77b9c8a912bbacfe8fdc9c5b3896d8a129c2b58f32a1356868fbcd
Opcode Fuzzy Hash: 14345e81860665dd88fc5b21882cf9813976ce1dd4121f2083c28ab1b41d5a00
Instruction Fuzzy Hash: 8B41BE29B19742A1F764ABA1D4A57F92398FF84B44F844036DD4D67796DE3CE1418B00

Function 00007FFD938E11DB Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD938F3863
X509_free.LIBCRYPTO-3 ref: 00007FFD938F3877
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD938F3884
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD938F3897
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938F38B0
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938F38EA
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938F3903
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938F391C
X509_STORE_free.LIBCRYPTO-3 ref: 00007FFD938F3928
X509_STORE_free.LIBCRYPTO-3 ref: 00007FFD938F3934
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938F3959
CRYPTO_THREAD_lock_free.LIBCRYPTO-3 ref: 00007FFD938F3965
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938F397A

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFD938F38A0, 00007FFD938F38CE, 00007FFD938F38F6, 00007FFD938F390F, 00007FFD938F394C, 00007FFD938F3970

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$E_freeX509_Y_free$D_lock_freeL_sk_pop_freeX509_free
String ID: ..\s\ssl\ssl_cert.c
API String ID: 3478116879-349359282
Opcode ID: 73eeb4c5e27859a205d1f8c0647ef6662eeac154cd29ec974cee8680553f9db9
Instruction ID: c0610403a88d990cd54361011936858aa9c88260f40e2c380dd2d44f003198f6
Opcode Fuzzy Hash: 73eeb4c5e27859a205d1f8c0647ef6662eeac154cd29ec974cee8680553f9db9
Instruction Fuzzy Hash: 0D31C535B18B42A1EB64AFE5D4A03BD6328FB81B84F040031EE5E67696DF7CE5918740

Function 00007FFD9395A770 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

BN_bin2bn.LIBCRYPTO-3(?,00007FFD9395BCA3), ref: 00007FFD9395A7CB
ERR_new.LIBCRYPTO-3(?,00007FFD9395BCA3), ref: 00007FFD9395A7DC
ERR_set_debug.LIBCRYPTO-3(?,00007FFD9395BCA3), ref: 00007FFD9395A7F4
CRYPTO_free.LIBCRYPTO-3(?,00007FFD9395BCA3), ref: 00007FFD9395A85D
CRYPTO_strdup.LIBCRYPTO-3(?,00007FFD9395BCA3), ref: 00007FFD9395A876
ERR_new.LIBCRYPTO-3 ref: 00007FFD9395A89A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395A8B2
ERR_new.LIBCRYPTO-3(?,00007FFD9395BCA3), ref: 00007FFD9395A927
ERR_set_debug.LIBCRYPTO-3(?,00007FFD9395BCA3), ref: 00007FFD9395A93F

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD9395A7ED, 00007FFD9395A849, 00007FFD9395A869, 00007FFD9395A8AB, 00007FFD9395A8FD, 00007FFD9395A938
tls_process_cke_srp, xrefs: 00007FFD9395A7E1, 00007FFD9395A89F, 00007FFD9395A8F1, 00007FFD9395A92C

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$N_bin2bnO_freeO_strdup
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_cke_srp
API String ID: 1764459405-322974352
Opcode ID: 74c333397c072aa9a6ddeb2cb3c3bf286bb879a8a81ad5ee7a14a1ec330dcb4f
Instruction ID: 2389acfb5dd7d83f94d241c3d0cb50a1d18942ad2d0879ca05ec9517b9e1a9e1
Opcode Fuzzy Hash: 74c333397c072aa9a6ddeb2cb3c3bf286bb879a8a81ad5ee7a14a1ec330dcb4f
Instruction Fuzzy Hash: C441AC65B18A43A5FB24ABF1E8327BA2358EF80B80F844031DD0E67792DE2DE5D1C740

Function 00007FFD938E17DF Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD938FC7FD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FC815
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FC826
CRYPTO_realloc.LIBCRYPTO-3 ref: 00007FFD938FC87B
ERR_new.LIBCRYPTO-3 ref: 00007FFD938FC888
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FC8A0
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FC8B0
CRYPTO_realloc.LIBCRYPTO-3 ref: 00007FFD938FC8DB
ERR_new.LIBCRYPTO-3 ref: 00007FFD938FC8E8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FC900
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FC911

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD938FC80E, 00007FFD938FC874, 00007FFD938FC899, 00007FFD938FC8C4, 00007FFD938FC8F9
dane_mtype_set, xrefs: 00007FFD938FC802, 00007FFD938FC88D, 00007FFD938FC8ED

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_realloc
String ID: ..\s\ssl\ssl_lib.c$dane_mtype_set
API String ID: 945340710-1331952108
Opcode ID: 0fb7b7cfeaf50520e69a1ec2a52772445afd1f7160cde6d5d69ac0a800822e94
Instruction ID: c4b33cd20c41d32df28a2c9459047e79e927c85a076fd33ae7e4ffb5ae5192c5
Opcode Fuzzy Hash: 0fb7b7cfeaf50520e69a1ec2a52772445afd1f7160cde6d5d69ac0a800822e94
Instruction Fuzzy Hash: 7841246AB1978662E3259BA0E8607BA63A8FB04744F404031EE4C337D1DF3CE695C700

Function 00007FFD93943210 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9394323F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93943257
ERR_new.LIBCRYPTO-3 ref: 00007FFD93943295
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939432AD
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9394338F
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93943397

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93943250, 00007FFD939432A6, 00007FFD93943307, 00007FFD93943355, 00007FFD93943382
tls_construct_cke_ecdhe, xrefs: 00007FFD93943244, 00007FFD9394329A, 00007FFD939432FB, 00007FFD93943349

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$O_freeY_free
String ID: ..\s\ssl\statem\statem_clnt.c$tls_construct_cke_ecdhe
API String ID: 110670684-68429018
Opcode ID: 19574f2e61a281cf3ab16a34cf9e91df21e7e9f984fe4a11bad3e619a205312a
Instruction ID: 664f9d1e0b78d38e07dabdb8757682611aefb9a87e16cd2a62557bda24c58b2c
Opcode Fuzzy Hash: 19574f2e61a281cf3ab16a34cf9e91df21e7e9f984fe4a11bad3e619a205312a
Instruction Fuzzy Hash: 8F41AC25B1C74262E734E7E2E8707AA2358AF95BC4F440032DD4E23AD6EF6CE5458B00

Function 00007FFD938ED140 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938ED15D
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD938ED1B3
ERR_new.LIBCRYPTO-3 ref: 00007FFD938ED1C8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938ED1E0
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938ED1F1
ERR_new.LIBCRYPTO-3 ref: 00007FFD938ED1FD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938ED215
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938ED226
ERR_new.LIBCRYPTO-3 ref: 00007FFD938ED22F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938ED247
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938ED258

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFD938ED150, 00007FFD938ED1A9, 00007FFD938ED1D9, 00007FFD938ED20E, 00007FFD938ED240
ssl3_ctrl, xrefs: 00007FFD938ED1CD, 00007FFD938ED202, 00007FFD938ED234

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_freeO_strdup
String ID: ..\s\ssl\s3_lib.c$ssl3_ctrl
API String ID: 1111623124-3079590724
Opcode ID: f81a6dad30362f2ac4d5aea5d7ea7990be999d68f5c66084f97cb660a3f56ef9
Instruction ID: de5b74c462600a8b5d9fcb7be5c7173433c3de7e51f62cc9b880d449aeccac79
Opcode Fuzzy Hash: f81a6dad30362f2ac4d5aea5d7ea7990be999d68f5c66084f97cb660a3f56ef9
Instruction Fuzzy Hash: C031AE1DB2E642A9F7B4A7E4D8307FA2359AF45744F904032D90D22A96DF2DF889CB11

Function 00007FFD93949850 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 102COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939498CE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939498E6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93949935
ERR_new.LIBCRYPTO-3 ref: 00007FFD939499D5
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939499ED

Strings

tls_process_ske_psk_preamble, xrefs: 00007FFD939498D3, 00007FFD939499A1, 00007FFD939499DA
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD939498DF, 00007FFD9394992E, 00007FFD939499AD, 00007FFD939499E6
D:\a\1\s\include\internal/packet.h, xrefs: 00007FFD9394996C, 00007FFD9394997E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$O_free
String ID: ..\s\ssl\statem\statem_clnt.c$D:\a\1\s\include\internal/packet.h$tls_process_ske_psk_preamble
API String ID: 1233037391-1906891150
Opcode ID: c32beb0c017250df2eee1c67452449d6fc53f1958ce219b8d056d47456d4651c
Instruction ID: 9217e92b73c4f75b3ff3bcd805879d1892e3e7842f03c9eece37348471a6dddb
Opcode Fuzzy Hash: c32beb0c017250df2eee1c67452449d6fc53f1958ce219b8d056d47456d4651c
Instruction Fuzzy Hash: 6241B625F2C69191E330ABE5E4257EA6354FB44B84F440131EE8D27A96DF3CE591CB00

Function 00007FFD93924230 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93924288
memset.VCRUNTIME140 ref: 00007FFD9392434D
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9392436F
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93924384

Strings

dtls1_buffer_record, xrefs: 00007FFD93924403
..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFD9392427D, 00007FFD93924362, 00007FFD9392437A, 00007FFD939243AB, 00007FFD939243C3, 00007FFD939243E7, 00007FFD9392440F

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$O_mallocmemset
String ID: ..\s\ssl\record\rec_layer_d1.c$dtls1_buffer_record
API String ID: 1168073369-935135588
Opcode ID: bbb203ea5b1a93dd05b961416e493a5b80071b6bef534c061022f91b52cc2d7b
Instruction ID: bbbb52fba1180b7e44548862a69fd4556a44febc63a1e3861ccb753da4b3723b
Opcode Fuzzy Hash: bbb203ea5b1a93dd05b961416e493a5b80071b6bef534c061022f91b52cc2d7b
Instruction Fuzzy Hash: B2519016F18B8191E734EFB5E9603B96364EB95B84F445231EE4D27796EF2CE1C18700

Function 00007FFD938E1582 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939217C3
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939217DC
BN_free.LIBCRYPTO-3 ref: 00007FFD939217E8
BN_free.LIBCRYPTO-3 ref: 00007FFD939217F4
BN_free.LIBCRYPTO-3 ref: 00007FFD93921800
BN_free.LIBCRYPTO-3 ref: 00007FFD9392180C
BN_free.LIBCRYPTO-3 ref: 00007FFD93921818
BN_free.LIBCRYPTO-3 ref: 00007FFD93921824
BN_free.LIBCRYPTO-3 ref: 00007FFD93921830
BN_free.LIBCRYPTO-3 ref: 00007FFD9392183C

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFD939217B6, 00007FFD939217CF

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: N_free$O_free
String ID: ..\s\ssl\tls_srp.c
API String ID: 3506937590-1778748169
Opcode ID: 6781f8122e26c314c91ead8aaa1f52217c11aaa97b0d55223e0b2e92c9ed18e1
Instruction ID: fd970dfaa35c25bb29941e73fbc1371d8913008b379782f26131326cce1bd085
Opcode Fuzzy Hash: 6781f8122e26c314c91ead8aaa1f52217c11aaa97b0d55223e0b2e92c9ed18e1
Instruction Fuzzy Hash: BA212C16F14B8292E765EFB1C8B53FC1328EBD4B48F086231FE5C5A256DF28A6D18710

Function 00007FFD938E16A4 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93935EAC
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93935EDA
ERR_new.LIBCRYPTO-3 ref: 00007FFD93935EF2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93935F0A
ERR_new.LIBCRYPTO-3 ref: 00007FFD93935F40
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93935F58
ERR_new.LIBCRYPTO-3 ref: 00007FFD93935FA2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93935FBA

Strings

tls_parse_stoc_sct, xrefs: 00007FFD93935EF7, 00007FFD93935F45, 00007FFD93935FA7
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93935EA5, 00007FFD93935ED0, 00007FFD93935F03, 00007FFD93935F51, 00007FFD93935FB3

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_malloc
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_parse_stoc_sct
API String ID: 3068916411-3063144252
Opcode ID: e3209f3bc727a2dd651899e6b245957a50e1b701d0121b7429ae77e6ae27f439
Instruction ID: 77e7a0ee3068a64bf116b3db11fd4138eb2b6e3374f18908c40f23c03bc79788
Opcode Fuzzy Hash: e3209f3bc727a2dd651899e6b245957a50e1b701d0121b7429ae77e6ae27f439
Instruction Fuzzy Hash: E241E465B08B42A1E374ABD2E8217EA6398EF84B80F580030ED4E27BD5DF7DE180C700

Function 00007FFD938E24E6 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93945F1C
ERR_new.LIBCRYPTO-3 ref: 00007FFD93945F34
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93945F4C
ERR_new.LIBCRYPTO-3 ref: 00007FFD93945F77
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93945F8F
ERR_new.LIBCRYPTO-3 ref: 00007FFD93945FCF
ERR_new.LIBCRYPTO-3 ref: 00007FFD93945FE2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93945FFA

Strings

tls_process_cert_status_body, xrefs: 00007FFD93945F39, 00007FFD93945F7C, 00007FFD93945FD4, 00007FFD93945FE7
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93945F13, 00007FFD93945F45, 00007FFD93945F88, 00007FFD93945FF3

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$R_set_debug$O_malloc
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_cert_status_body
API String ID: 2635154176-3889181619
Opcode ID: 5fcd6836c9caa6e40f406a546cb1020a66fccfedf7f6b9b8c4a4320bd35a03f7
Instruction ID: 65c96b775a303b9aa9b4f955fe444ecc100034ef8cb6704b71a11114e94e1ffe
Opcode Fuzzy Hash: 5fcd6836c9caa6e40f406a546cb1020a66fccfedf7f6b9b8c4a4320bd35a03f7
Instruction Fuzzy Hash: 1F41C321B18B51A1E764ABE1E8207BD6398FF45B80F844032EA4E27BD6DF2CE5918700

Function 00007FFD939312E0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93931322
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393133A
EVP_PKEY_get1_encoded_public_key.LIBCRYPTO-3 ref: 00007FFD93931380
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939313E8
ERR_new.LIBCRYPTO-3 ref: 00007FFD939313FE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93931413
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93931437
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9393144E

Strings

add_key_share, xrefs: 00007FFD93931327, 00007FFD93931403
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93931333, 00007FFD939313CD, 00007FFD9393140C, 00007FFD93931441

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeR_newR_set_debug$Y_freeY_get1_encoded_public_key
String ID: ..\s\ssl\statem\extensions_clnt.c$add_key_share
API String ID: 2306805868-2958431780
Opcode ID: 0effa3f28fd81e029e1e2bef8d3d4f795195dbca90a63bb6ef66fcf9d34d6eaf
Instruction ID: 4e1e19ed83bd8ecc37ea012bd7ab46e369c4755f3a3ee426b15f63d50a0cbfeb
Opcode Fuzzy Hash: 0effa3f28fd81e029e1e2bef8d3d4f795195dbca90a63bb6ef66fcf9d34d6eaf
Instruction Fuzzy Hash: 4F41B365B0C642A1EB74B7D5E8647BA2398EF45BC4F140431EE8D27BEADE7DD5808700

Function 00007FFD938E23D8 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 122COMMON

Download Yara Rule

Strings

ssl3_setup_key_block, xrefs: 00007FFD938EC47E
..\s\ssl\s3_enc.c, xrefs: 00007FFD938EC42B, 00007FFD938EC451, 00007FFD938EC48A

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: ..\s\ssl\s3_enc.c$ssl3_setup_key_block
API String ID: 0-2303705756
Opcode ID: 7ab0987e915193302a3a42c673fd026e7866da21d55a71d85de0a0bc2a63dbcb
Instruction ID: 8375ae3701d99f611a2a511eb0e637a05d1456ff47c81385b6741d53be2ecd55
Opcode Fuzzy Hash: 7ab0987e915193302a3a42c673fd026e7866da21d55a71d85de0a0bc2a63dbcb
Instruction Fuzzy Hash: C851A036B08B8596E778EBA5E1643EDB3A8FB88B80F400135EB5C53745DF79E1618B40

Function 00007FFD939235E0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93923635
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9392364B
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFD9392369B
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939236B0
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939236C6
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFD9392371B
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93923730
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93923746

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFD93923624, 00007FFD9392363E, 00007FFD939236A3, 00007FFD939236B9, 00007FFD93923723, 00007FFD93923739

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$L_cleanse
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 927910673-1306860146
Opcode ID: 87c20ce79d9b1f955aa4e8903e29a6a14f52e0d8b90f8ee282dfd8fdd339abbe
Instruction ID: 194e458729ecb0548e190c402cca9474701cb362acc00d5997b2733e27d25bb4
Opcode Fuzzy Hash: 87c20ce79d9b1f955aa4e8903e29a6a14f52e0d8b90f8ee282dfd8fdd339abbe
Instruction Fuzzy Hash: 7D515C66B15B4291EB24EFA6D4A03692368FBC8F84F049135DE4D27B5ADF28E481C700

Function 00007FFD93954809 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939548C1
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD939548E6
ERR_new.LIBCRYPTO-3 ref: 00007FFD939548FE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93954916
ERR_new.LIBCRYPTO-3 ref: 00007FFD93954970
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93954988

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD9395490F, 00007FFD93954981
D:\a\1\s\include\internal/packet.h, xrefs: 00007FFD939548B4, 00007FFD939548DA
tls_process_next_proto, xrefs: 00007FFD93954903, 00007FFD93954975

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_memdup
String ID: ..\s\ssl\statem\statem_srvr.c$D:\a\1\s\include\internal/packet.h$tls_process_next_proto
API String ID: 3243760035-2889161144
Opcode ID: e120c9a872ecc42cddbb7fd9e87eb454002df738bb9dd558f99bda084246718d
Instruction ID: f55f100780cae1e4447b334051508f2e1b05f21b0f5c86c1f0acd12cdcbd122b
Opcode Fuzzy Hash: e120c9a872ecc42cddbb7fd9e87eb454002df738bb9dd558f99bda084246718d
Instruction Fuzzy Hash: C041D526B1C78191E7209B95F4203BAA3A8FB95B84F440131EECD27B96EF6CD5D18740

Function 00007FFD938E236F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9395BFF4
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD9395C019
ERR_new.LIBCRYPTO-3 ref: 00007FFD9395C031
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395C049
ERR_new.LIBCRYPTO-3 ref: 00007FFD9395C08E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395C0A6

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD9395C042, 00007FFD9395C09F
D:\a\1\s\include\internal/packet.h, xrefs: 00007FFD9395BFE2, 00007FFD9395C00D
tls_process_next_proto, xrefs: 00007FFD9395C036, 00007FFD9395C093

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_memdup
String ID: ..\s\ssl\statem\statem_srvr.c$D:\a\1\s\include\internal/packet.h$tls_process_next_proto
API String ID: 3243760035-2889161144
Opcode ID: a3c409e485f6a926ab1cdfc2d714f3772bd454bb9213ec4b09bab610af5c7fe9
Instruction ID: d3cc98ea98deb448151f9dc72f775ac9543f8ce89bc58e4b45d537e07dd47d54
Opcode Fuzzy Hash: a3c409e485f6a926ab1cdfc2d714f3772bd454bb9213ec4b09bab610af5c7fe9
Instruction Fuzzy Hash: 8E41B726B1DB8195EB309BA1E4203B9B3A4FB59784F444131EE8D67696EF7CD2D08B40

Function 00007FFD938E20EF Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD939191D9
ERR_new.LIBCRYPTO-3 ref: 00007FFD939191E6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939191FE
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9391920E

Strings

tls1_set_sigalgs, xrefs: 00007FFD939191EB
..\s\ssl\t1_lib.c, xrefs: 00007FFD939191BD, 00007FFD939191F7, 00007FFD93919275, 00007FFD939192A9

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_mallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\t1_lib.c$tls1_set_sigalgs
API String ID: 2261483606-2076144160
Opcode ID: d1036dbe8b9a9d680c55c8a37dc255ee52f0efd95901680dc470d1b35e351fcc
Instruction ID: 8e1627d36b12709d98198da87ba4f624e83e1eab7edf9b78f2094f3ed88033ed
Opcode Fuzzy Hash: d1036dbe8b9a9d680c55c8a37dc255ee52f0efd95901680dc470d1b35e351fcc
Instruction Fuzzy Hash: 4241E425B08742A5E7B4DBE9E4607EAB365EB49B80F544434DE4D33B86DE3CE480C750

Function 00007FFD938E11BD Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD939193FA
ERR_new.LIBCRYPTO-3 ref: 00007FFD93919407
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9391941F
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9391942F

Strings

tls1_set_raw_sigalgs, xrefs: 00007FFD9391940C
..\s\ssl\t1_lib.c, xrefs: 00007FFD939193D1, 00007FFD93919418, 00007FFD93919446

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_mallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\t1_lib.c$tls1_set_raw_sigalgs
API String ID: 2261483606-2202831108
Opcode ID: f881d78ce60898aab7decfc7794186c0dca4c0da06903e580fa000e5301e5333
Instruction ID: e77784328bdbacb5287e45b77e8916902661414ba27a7ca10b74c48be5b33546
Opcode Fuzzy Hash: f881d78ce60898aab7decfc7794186c0dca4c0da06903e580fa000e5301e5333
Instruction Fuzzy Hash: 57315C76719791A1E770DBD6E8607EA6369EB49B80F440136DE8E27B86DF3CE140CB10

Function 00007FFD93928810 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD939288B1
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9392895A
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93928975
ERR_new.LIBCRYPTO-3 ref: 00007FFD939289E4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939289F1

Strings

ssl3_setup_read_buffer, xrefs: 00007FFD939288C0
ssl3_setup_write_buffer, xrefs: 00007FFD939289CE
..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FFD9392883B

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_malloc$O_freeR_newR_set_debug
String ID: ..\s\ssl\record\ssl3_buffer.c$ssl3_setup_read_buffer$ssl3_setup_write_buffer
API String ID: 2137838121-2302522825
Opcode ID: b2237dc3ad2a0b7f9fbd81a1f7904b293cd1b0b1d027716fef620bf8d9d518d0
Instruction ID: 446f284e17316a11d1cb05d5ad09bb4deaccc760916ba3e9949aef4f71d6b150
Opcode Fuzzy Hash: b2237dc3ad2a0b7f9fbd81a1f7904b293cd1b0b1d027716fef620bf8d9d518d0
Instruction Fuzzy Hash: 4051DF76B08B4191FB20AB96E8647A973E8FB84B88F590535DE5C67795CF3DD881C300

Function 00007FFD938E25D6 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD939337C1
ERR_new.LIBCRYPTO-3 ref: 00007FFD939337DF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939337F7
memcpy.VCRUNTIME140 ref: 00007FFD93933826
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393388C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939338A4

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD939337B2, 00007FFD939337F0, 00007FFD9393389D
tls_construct_ctos_session_ticket, xrefs: 00007FFD939337E4, 00007FFD93933891

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$O_mallocmemcpy
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_session_ticket
API String ID: 1077327330-3277354937
Opcode ID: 34f50cc33240a351c06fc794800c2bbf0ccc92b46abde09b13168cf331eeefe5
Instruction ID: 84d88ac5ead8d83f8368a107e48cbf00d6a6445f94281c522a615a0f054a7eac
Opcode Fuzzy Hash: 34f50cc33240a351c06fc794800c2bbf0ccc92b46abde09b13168cf331eeefe5
Instruction Fuzzy Hash: 7A41A2A6B09647A1FB789B95D4A03B863A8FB44F80F484035DA0E67BD5CF7CE990C700

Function 00007FFD938E1361 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD93915C4C
EVP_PKEY_set_type.LIBCRYPTO-3 ref: 00007FFD93915CD1
EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3 ref: 00007FFD93915CEB
EVP_PKEY_CTX_free.LIBCRYPTO-3 ref: 00007FFD93915CFA
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFD93915D1C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93915D40
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93915D48

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFD93915C3E, 00007FFD93915D36

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_mallocR_pop_to_markX_freeX_new_from_pkeyY_freeY_set_type
String ID: ..\s\ssl\t1_lib.c
API String ID: 355840433-1643863364
Opcode ID: 3db9531d2b6dc588749f5d3fc88387a9a97764fba650647e6dd075ed364377c7
Instruction ID: 1dfe389801e8e98ce75145f7ae8a8982f13d2e866ed356315c46929976170a20
Opcode Fuzzy Hash: 3db9531d2b6dc588749f5d3fc88387a9a97764fba650647e6dd075ed364377c7
Instruction Fuzzy Hash: C631D066B0978291E620EFD5E5603BE63A8FB49B88F414031EE4C37746DF38E1958700

Function 00007FFD938E23EC Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD938FDB4F
ERR_new.LIBCRYPTO-3 ref: 00007FFD938FDB5C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FDB74
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FDB84
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938FDBB0
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938FDBF4

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD938FDB46, 00007FFD938FDB6D, 00007FFD938FDBA3, 00007FFD938FDBE7
SSL_CTX_set_alpn_protos, xrefs: 00007FFD938FDB61

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$O_memdupR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_CTX_set_alpn_protos
API String ID: 4248801101-316209205
Opcode ID: bf4364809ae8a05de32655148bce9c8f48aa6b28b6be34ffc1ce87862ef84e29
Instruction ID: 35757db12599435d45c2f00eb4c785ab3da5f755c6e7e001ac4159ac4f837563
Opcode Fuzzy Hash: bf4364809ae8a05de32655148bce9c8f48aa6b28b6be34ffc1ce87862ef84e29
Instruction Fuzzy Hash: 2A31E575F2868692E7708BA0E460BAA2398FF45B84F481031DE4D23F89DE2CE885C700

Function 00007FFD938E1401 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD939182C7
ERR_new.LIBCRYPTO-3 ref: 00007FFD939182D4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939182EC
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD939182FC
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9391836D
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9391837D

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFD939182B1, 00007FFD939182E5, 00007FFD93918358
tls1_save_u16, xrefs: 00007FFD939182D9

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$O_mallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\t1_lib.c$tls1_save_u16
API String ID: 1304317871-3868075628
Opcode ID: 191a281176afeb264a1d7232f9b2cfbaaed705c110a9ced922615b568f44c63c
Instruction ID: 6f24519df64802f456a3a209518930158d99f6d14f0e40eb893246fd376f0899
Opcode Fuzzy Hash: 191a281176afeb264a1d7232f9b2cfbaaed705c110a9ced922615b568f44c63c
Instruction Fuzzy Hash: CB319025B1CB92A1E760CBD1E5603AE6368EB89BC0F484031EA4D73B96DE3DE941D700

Function 00007FFD938E2126 Relevance: 13.6, APIs: 9, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFD9395E0A0
memset.VCRUNTIME140 ref: 00007FFD9395E0C4
RtlCaptureContext.KERNEL32 ref: 00007FFD9395E0CD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFD9395E0E7
RtlVirtualUnwind.KERNEL32 ref: 00007FFD9395E128
memset.VCRUNTIME140 ref: 00007FFD9395E15B
IsDebuggerPresent.KERNEL32 ref: 00007FFD9395E17C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFD9395E19D
UnhandledExceptionFilter.KERNEL32 ref: 00007FFD9395E1A8

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 8ddad5856ca7d92d08f3a49177604ac729a807c7ded62544596a6cea2bdea3ec
Instruction ID: 9c8ef9e93c5bdea1b0408f1eabbf4950eaa8a67396ae2bdf10f4a0178c850918
Opcode Fuzzy Hash: 8ddad5856ca7d92d08f3a49177604ac729a807c7ded62544596a6cea2bdea3ec
Instruction Fuzzy Hash: CB315C76B09B819AEB709FA0E8603ED6368FB84744F40403ADA4D67B98EF3DD548C714

Function 00007FFD93906758 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 130COMMON

Download Yara Rule

Strings

%02x, xrefs: 00007FFD939068B5, 00007FFD939068F5
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93906809, 00007FFD93906858, 00007FFD9390692D
nss_keylog_int, xrefs: 00007FFD9390684C

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: %02x$..\s\ssl\ssl_lib.c$nss_keylog_int
API String ID: 0-321016803
Opcode ID: 46b257941670f0170780c4bea91d59f85c5130b6669692529197f8fcf2474ec3
Instruction ID: 2a6577c5b32b31000292313a6ef9aec2b6d3c83b6ef0d62fc00e8123dbbb4adf
Opcode Fuzzy Hash: 46b257941670f0170780c4bea91d59f85c5130b6669692529197f8fcf2474ec3
Instruction Fuzzy Hash: 0C510827B0D78296EB619F99F46036A6798FB45B84F480036DE8D27796DF3DE041C700

Function 00007FFD938F7730 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3(?,00000000,?,00007FFD938F74DB), ref: 00007FFD938F7797
ERR_new.LIBCRYPTO-3(?,00000000,?,00007FFD938F74DB), ref: 00007FFD938F77A4
ERR_set_debug.LIBCRYPTO-3(?,00000000,?,00007FFD938F74DB), ref: 00007FFD938F77BC
ERR_set_error.LIBCRYPTO-3(?,00000000,?,00007FFD938F74DB), ref: 00007FFD938F77CC
CRYPTO_free.LIBCRYPTO-3(?,00000000,?,00007FFD938F74DB), ref: 00007FFD938F78A7

Strings

ssl_cipher_strength_sort, xrefs: 00007FFD938F77A9
..\s\ssl\ssl_ciph.c, xrefs: 00007FFD938F7782, 00007FFD938F77B5, 00007FFD938F789D

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_zallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_ciph.c$ssl_cipher_strength_sort
API String ID: 2487674020-1223572542
Opcode ID: b04ef35ca2b519efab378e83bc892820f751471ee896cde5e0915d34dc851a37
Instruction ID: f0095d9b14cee98032bfc2f00343b17a03f699e983bcea5ef0c9b9ab5ba7b342
Opcode Fuzzy Hash: b04ef35ca2b519efab378e83bc892820f751471ee896cde5e0915d34dc851a37
Instruction Fuzzy Hash: FE41D076B14B4186FA24CF91E5606B937A9FB44BC0F508432EE0C63745EF3AE980C780

Function 00007FFD93937770 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD939377BC
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD93937836
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD93937856
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939378B8
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939378CE
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939378F7

Strings

..\s\ssl\statem\extensions_cust.c, xrefs: 00007FFD939377AB, 00007FFD93937824, 00007FFD9393783F, 00007FFD939378AB, 00007FFD939378C1, 00007FFD939378EA

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\statem\extensions_cust.c
API String ID: 3962629258-3973221358
Opcode ID: f513b24519971439065d8ac0baefa25f29694b2f961c74c5c8df209c3117cd2f
Instruction ID: c4d7a5d3f591393d0c7df1b3426bf8acea744ecea6f43208aa204092b5c75877
Opcode Fuzzy Hash: f513b24519971439065d8ac0baefa25f29694b2f961c74c5c8df209c3117cd2f
Instruction Fuzzy Hash: E641A276B09B46A1EB34DB81F4A07A963A8FB44B88F054136DE9D17B90EF7CE590C300

Function 00007FFD938E222A Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9395BC1A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395BC32
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD9395BD30

Part of subcall function 00007FFD93959F10: ERR_new.LIBCRYPTO-3(?,?,00007FFD9395BC05), ref: 00007FFD93959F9D
Part of subcall function 00007FFD93959F10: ERR_set_debug.LIBCRYPTO-3(?,?,00007FFD9395BC05), ref: 00007FFD93959FB5

Part of subcall function 00007FFD938E1CEE: CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD938EFC82
Part of subcall function 00007FFD938E1CEE: memset.VCRUNTIME140 ref: 00007FFD938EFCB0
Part of subcall function 00007FFD938E1CEE: memcpy.VCRUNTIME140 ref: 00007FFD938EFCE5
Part of subcall function 00007FFD938E1CEE: CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD938EFD01
Part of subcall function 00007FFD938E1CEE: CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD938EFD5A
Part of subcall function 00007FFD938E1CEE: CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD938EFDD2

Strings

tls_process_client_key_exchange, xrefs: 00007FFD9395BC1F, 00007FFD9395BCE7
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD9395BC2B, 00007FFD9395BCF3, 00007FFD9395BD1C

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_clear_free$R_newR_set_debug$O_mallocmemcpymemset
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_client_key_exchange
API String ID: 1067245891-2687227884
Opcode ID: 4347a22b7538b2f0fac3c4a6be788767f3649102e8d0188d1ae8a515132bdfe7
Instruction ID: e588389bca3ec81271411ba3d34279410067c4eb1affa220a74534e6fe2b0a87
Opcode Fuzzy Hash: 4347a22b7538b2f0fac3c4a6be788767f3649102e8d0188d1ae8a515132bdfe7
Instruction Fuzzy Hash: 6E412E61B1C74364F6749BE9E8767BA1399AF44B80F544032DD0F67BDACE6CE4818704

Function 00007FFD938E1087 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD938FB75F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FB777
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FB788
CRYPTO_THREAD_run_once.LIBCRYPTO-3 ref: 00007FFD938FB7F2
CRYPTO_THREAD_run_once.LIBCRYPTO-3 ref: 00007FFD938FB81B

Strings

..\s\ssl\ssl_init.c, xrefs: 00007FFD938FB770
OPENSSL_init_ssl, xrefs: 00007FFD938FB764

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: D_run_once$R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_init.c$OPENSSL_init_ssl
API String ID: 3879570137-3839768916
Opcode ID: 666247f15fd5848fa57251a9335fcc4b0e3714a3a6f5c17cf0bb252670204cea
Instruction ID: 3dba35cabcb1d6c9b640be996dbabaa502a4c289a2ed95c76f353087f2d73d9c
Opcode Fuzzy Hash: 666247f15fd5848fa57251a9335fcc4b0e3714a3a6f5c17cf0bb252670204cea
Instruction Fuzzy Hash: B131C321B1D203A6FB70ABD5E8717B9239DAFC0380F981135D81E626D1DF2DE981C780

Function 00007FFD938E26AD Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD938FE704
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FE71C
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FE72C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938FE759
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD938FE773

Strings

SSL_CTX_use_psk_identity_hint, xrefs: 00007FFD938FE709
..\s\ssl\ssl_lib.c, xrefs: 00007FFD938FE715, 00007FFD938FE745, 00007FFD938FE769

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_strdupR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_CTX_use_psk_identity_hint
API String ID: 598019968-601318550
Opcode ID: 9805dc3135f462e5b1b8f8fa41e784a61d9077c7ea73bfb9628992d08bc5ff00
Instruction ID: 83f906526a8b0be9d1d63ef4e56bb5ac7cbb6a3a05f5373712dc24e09b3b34b6
Opcode Fuzzy Hash: 9805dc3135f462e5b1b8f8fa41e784a61d9077c7ea73bfb9628992d08bc5ff00
Instruction Fuzzy Hash: EC21C461F28746A5FBA4D7E5E8A43F92394FB48780F444031DA4D977D2DE2DE8818700

Function 00007FFD938E22D4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD9391879E
CONF_parse_list.LIBCRYPTO-3 ref: 00007FFD939187D3
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD939187FB
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93918818
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9391883F

Strings

(, xrefs: 00007FFD93918776
..\s\ssl\t1_lib.c, xrefs: 00007FFD93918787, 00007FFD939187E6, 00007FFD9391880B, 00007FFD93918832

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$F_parse_listO_mallocO_memdup
String ID: ($..\s\ssl\t1_lib.c
API String ID: 3703324232-198664497
Opcode ID: 1887056e8af1d745cb53f732cd401761057caae5ad505e6df00a298f56d3623d
Instruction ID: 2bd30437669e0a9e8b9c6da78e085db2f6e964fd202b50a5f04bb8ad70791b0b
Opcode Fuzzy Hash: 1887056e8af1d745cb53f732cd401761057caae5ad505e6df00a298f56d3623d
Instruction Fuzzy Hash: 89216F36B09B4292EB209B85F4903AA6769FB89BC0F144035EE8D67B99DF3CD551CB00

Function 00007FFD938E2590 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD939238E4
ERR_new.LIBCRYPTO-3 ref: 00007FFD939238F1
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93923907
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93923917

Strings

DTLS_RECORD_LAYER_new, xrefs: 00007FFD939238F6
..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFD939238DD, 00007FFD93923900, 00007FFD9392398D

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_mallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\record\rec_layer_d1.c$DTLS_RECORD_LAYER_new
API String ID: 2261483606-2598386108
Opcode ID: b4b8396036985612f7ae0a8ffb7ed2bc61f330508f79e3ce729188609297376b
Instruction ID: bd3202c988d840958001f8e1f64b4a3142ec241eafecc17a6fdf7395360a23c1
Opcode Fuzzy Hash: b4b8396036985612f7ae0a8ffb7ed2bc61f330508f79e3ce729188609297376b
Instruction Fuzzy Hash: B7217165B28B0291EB78BBE5E4A13B92398EF84B44F441035DA0D277C6EE2DE890C740

Function 00007FFD93941126 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939411FD
ERR_new.LIBCRYPTO-3 ref: 00007FFD93941219
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93941231
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9394125B

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD939411F0, 00007FFD9394122A, 00007FFD9394124E
tls_process_encrypted_extensions, xrefs: 00007FFD9394121E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_encrypted_extensions
API String ID: 3271392029-215004271
Opcode ID: 722d444f2522c4f7b79969b85d7b454d2b473e7931e03076ba07f6d6bf35ef80
Instruction ID: f20e50d2a2a04397c0bee8dbd1f7a5488eeab482ba0a010a021e0e42bc02bcf9
Opcode Fuzzy Hash: 722d444f2522c4f7b79969b85d7b454d2b473e7931e03076ba07f6d6bf35ef80
Instruction Fuzzy Hash: E831C872B2C79191EB609BD1F4543AAA798FB847D8F044131EA8D67B4DDF7CD1908B00

Function 00007FFD939466E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939467D2
ERR_new.LIBCRYPTO-3 ref: 00007FFD939467E2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939467FA
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93946824

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD939467C5, 00007FFD939467F3, 00007FFD93946817
tls_process_encrypted_extensions, xrefs: 00007FFD939467E7

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_encrypted_extensions
API String ID: 3271392029-215004271
Opcode ID: ac0c1e3f4ecaa30dbc65637333d3f67ef54ed854728198c7015c504b23501b3e
Instruction ID: 90a8e523c9af6c548fe0a37492fe8163c4f1ed6cb3cad5b8f50bbaaaf9e91c2a
Opcode Fuzzy Hash: ac0c1e3f4ecaa30dbc65637333d3f67ef54ed854728198c7015c504b23501b3e
Instruction Fuzzy Hash: 4731D4B2B2878151E7609BE0E4657AA7794FB84784F005135EACD67B99DF7CD1C4CB00

Function 00007FFD9394D170 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD9394D1AE
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394D1BB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394D1D3
memcpy.VCRUNTIME140 ref: 00007FFD9394D225

Strings

construct_key_exchange_tbs, xrefs: 00007FFD9394D1C0
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD9394D19A, 00007FFD9394D1CC

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_mallocR_newR_set_debugmemcpy
String ID: ..\s\ssl\statem\statem_lib.c$construct_key_exchange_tbs
API String ID: 3542074325-1491770217
Opcode ID: 204a1c1f0aea44cfdd663ba2e0a8cdd82f61fa154370159ceae9c60c6935e93a
Instruction ID: 5d23eb39fba2465b2ef48c7868c581a8f8ca4131f2d13309ace50c16ec1a204a
Opcode Fuzzy Hash: 204a1c1f0aea44cfdd663ba2e0a8cdd82f61fa154370159ceae9c60c6935e93a
Instruction Fuzzy Hash: D321A426F08B81A2E725DBA5E9116E96724FB98B80F449231DF4C23757EF38E2D5C700

Function 00007FFD938E4300 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFD938E4350
ERR_new.LIBCRYPTO-3 ref: 00007FFD938E435E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938E4374
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938E4384

Strings

wpacket_intern_init_len, xrefs: 00007FFD938E4363
..\s\crypto\packet.c, xrefs: 00007FFD938E432C, 00007FFD938E436D

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_zallocR_newR_set_debugR_set_error
String ID: ..\s\crypto\packet.c$wpacket_intern_init_len
API String ID: 3755831613-2385383871
Opcode ID: 667439262e8e2320ee444a3f9abe47934b0530f35cbc9dec6e428bd711a76e2b
Instruction ID: 2e077996b039690792abce6b7bacded806b9285f87702a1617b3b77551445b18
Opcode Fuzzy Hash: 667439262e8e2320ee444a3f9abe47934b0530f35cbc9dec6e428bd711a76e2b
Instruction Fuzzy Hash: 31110632B1974196D768EFD8F4906A973A8FF48748F984034DA0C57B46EF39E5A2C700

Function 00007FFD938F47F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

i2d_X509_NAME.LIBCRYPTO-3 ref: 00007FFD938F4817
i2d_X509_NAME.LIBCRYPTO-3 ref: 00007FFD938F4827
memcmp.VCRUNTIME140 ref: 00007FFD938F484C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938F486A
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938F4881

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFD938F4860, 00007FFD938F4874

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeX509_i2d_$memcmp
String ID: ..\s\ssl\ssl_cert.c
API String ID: 1487052844-349359282
Opcode ID: dc1644b5511a283c6f7cb63a4157bf06027d02ec6f6bc83d03ceb41eb3366968
Instruction ID: d63812a07c06589ba284b2f4b66f47958545e186703d5973e9c40a7d79fd7fb4
Opcode Fuzzy Hash: dc1644b5511a283c6f7cb63a4157bf06027d02ec6f6bc83d03ceb41eb3366968
Instruction Fuzzy Hash: 8B012B26B0C74351EB30ABD9F46026B576ADF85BD0F140031EE5D57B99DE3ED4804B00

Function 00007FFD938E1389 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FFD938E4276
ERR_new.LIBCRYPTO-3 ref: 00007FFD938E4284
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938E429A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938E42AA

Strings

wpacket_intern_init_len, xrefs: 00007FFD938E4289
..\s\crypto\packet.c, xrefs: 00007FFD938E4258, 00007FFD938E4293

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_zallocR_newR_set_debugR_set_error
String ID: ..\s\crypto\packet.c$wpacket_intern_init_len
API String ID: 3755831613-2385383871
Opcode ID: 06cd698d7b9b9c1015e08acfd5484ab58efbd7fefce8ff155c0a379484c2fd19
Instruction ID: 19042725ad86714d6ca2c07053255944e0843e80f9101aff9ac8300c84d1058f
Opcode Fuzzy Hash: 06cd698d7b9b9c1015e08acfd5484ab58efbd7fefce8ff155c0a379484c2fd19
Instruction Fuzzy Hash: C311E332B0874292D724AFE8F4902A973A8FB04728FA44234DA6C177D1DF39D592C700

Function 00007FFD9394B0D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3(?,00000000,?,?,?,00007FFD9394ADAD), ref: 00007FFD9394B260
CRYPTO_free.LIBCRYPTO-3(?,00000000,?,?,?,00007FFD9394ADAD), ref: 00007FFD9394B276
CRYPTO_free.LIBCRYPTO-3(?,00000000,?,?,?,00007FFD9394ADAD), ref: 00007FFD9394B28B

Part of subcall function 00007FFD9394A930: CRYPTO_zalloc.LIBCRYPTO-3(?,00007FFD93949E38), ref: 00007FFD9394A96B
Part of subcall function 00007FFD9394A930: ERR_new.LIBCRYPTO-3(?,00007FFD93949E38), ref: 00007FFD9394A978
Part of subcall function 00007FFD9394A930: ERR_set_debug.LIBCRYPTO-3(?,00007FFD93949E38), ref: 00007FFD9394A98E
Part of subcall function 00007FFD9394A930: ERR_set_error.LIBCRYPTO-3(?,00007FFD93949E38), ref: 00007FFD9394A99E

CRYPTO_free.LIBCRYPTO-3(?,00000000,?,?,?,00007FFD9394ADAD), ref: 00007FFD9394B41D

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FFD9394B253, 00007FFD9394B269, 00007FFD9394B281, 00007FFD9394B413

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$O_zallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\statem\statem_dtls.c
API String ID: 346603204-3140652063
Opcode ID: ef80318c4711b4b759b5a82d33388bf0b19f1c365fadacbfa456b2f4d669c9f1
Instruction ID: d058933ccc51e738951edf5a6131dbaae4a1a96fe23c88b4371a025ac8ef5eb3
Opcode Fuzzy Hash: ef80318c4711b4b759b5a82d33388bf0b19f1c365fadacbfa456b2f4d669c9f1
Instruction Fuzzy Hash: ECA1F172708A9592EB34CB65D8642BE77A4FB55B84F044232DB8E53B86EF3CE194C740

Function 00007FFD938E108C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9393184B

Strings

tls_construct_ctos_cookie, xrefs: 00007FFD9393180A
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93931816, 00007FFD9393183E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_cookie
API String ID: 2581946324-1257894829
Opcode ID: 71d92291d3b78b7b1c5af275acf163bb73349c58d5933bb904c1c39a485cacda
Instruction ID: 57ad3e429c95ea5064efd1a6cf091bea4e7ff78f9d901f04d73a43e7b53ac5fc
Opcode Fuzzy Hash: 71d92291d3b78b7b1c5af275acf163bb73349c58d5933bb904c1c39a485cacda
Instruction Fuzzy Hash: 472192A5B18646A1F774BB92E5607BA2358EF44BC8F180031EE4D6BBDADF2CD541C710

Function 00007FFD93940700 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93940735
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394074D
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD9394079D

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93940746, 00007FFD93940790
tls_client_key_exchange_post_work, xrefs: 00007FFD9394073A

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_clear_freeR_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_client_key_exchange_post_work
API String ID: 868266018-2346923134
Opcode ID: de79e8b39e11c8c62ec5b26a70c4fe3dacaf3cab57f0f9421278fbee4736eca7
Instruction ID: fc221adbffe8c17a06ceb45cae3c81afdc9ed5649cd003933550e22d5a10862d
Opcode Fuzzy Hash: de79e8b39e11c8c62ec5b26a70c4fe3dacaf3cab57f0f9421278fbee4736eca7
Instruction Fuzzy Hash: 80115125B1875662F7B4ABE29A257B96358BF44FC4F480132DD4E777CACE2CE5418B00

Function 00007FFD938E1262 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

X509_free.LIBCRYPTO-3 ref: 00007FFD938F30F4
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD938F3101
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD938F3114
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938F312D

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FFD938F311D

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_pop_freeO_freeX509_freeY_free
String ID: ..\s\ssl\ssl_cert.c
API String ID: 1247630535-349359282
Opcode ID: 24b314e282b566103a9c86e58b143d12934b6053f160aa45369882e913cf9f7a
Instruction ID: 9d64774e3b501e430de1e7a3627ed855dbaa971eaf2d5d3ed80df7bfa9809673
Opcode Fuzzy Hash: 24b314e282b566103a9c86e58b143d12934b6053f160aa45369882e913cf9f7a
Instruction Fuzzy Hash: CC01A13AB18B5191E760ABA5E0A02AD3368FB84F88F040131EF8D67B49CF7CD651C780

Function 00007FFD938E139D Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD9390E45D
CRYPTO_THREAD_read_lock.LIBCRYPTO-3 ref: 00007FFD9390E471
OPENSSL_LH_retrieve.LIBCRYPTO-3 ref: 00007FFD9390E48E
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFD9390E4B0
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFD9390E4C8

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: D_unlock$D_read_lockH_retrievememcpy
String ID:
API String ID: 3379989983-0
Opcode ID: b56bc4609a403205738e1537f0386d817e3d71f52d62407c5673418f8bd9494f
Instruction ID: 5042c778425baf949060e2213fdeed1b5b0147b44bdc5bb4593f874a2c6a0bb6
Opcode Fuzzy Hash: b56bc4609a403205738e1537f0386d817e3d71f52d62407c5673418f8bd9494f
Instruction Fuzzy Hash: 2A31086AB1AA8296EA75ABD2D4603B97368FF84F88F044032DE0D57791EF3CE051C700

Function 00007FFD9392D2F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

RAND_bytes_ex.LIBCRYPTO-3 ref: 00007FFD9392D3D6
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FFD9392D3F9
memset.VCRUNTIME140 ref: 00007FFD9392D455

Strings

..\s\ssl\record\tls_pad.c, xrefs: 00007FFD9392D3EF

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: D_bytes_exO_mallocmemset
String ID: ..\s\ssl\record\tls_pad.c
API String ID: 2022753641-3631836059
Opcode ID: 20b6bad2e288fa1953e84d48e46959ade97dca001cf6e78dcd1cc0bfb829beb0
Instruction ID: 7e8a453d568a1eed8201ca319d22b84034980bdf28a32002b3b515933508e628
Opcode Fuzzy Hash: 20b6bad2e288fa1953e84d48e46959ade97dca001cf6e78dcd1cc0bfb829beb0
Instruction Fuzzy Hash: 4A610233718B845AEA71CFA1E420BEAA7A5F749B88F084131EE9D47B84EE3CD145C700

Function 00007FFD938F97B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938F985C
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD938F9871

Strings

..\s\ssl\ssl_conf.c, xrefs: 00007FFD938F9855, 00007FFD938F9867
gfffffff, xrefs: 00007FFD938F982D

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_strdup
String ID: ..\s\ssl\ssl_conf.c$gfffffff
API String ID: 2148955802-4123734156
Opcode ID: f6d5f6f74aca4813406220e93ac092d3ea3d90d5a024274672e554b65dd5b593
Instruction ID: f900809395ea020ae0f5d5745581b63fdc8d1b0f67496ccb8d339c28b487050b
Opcode Fuzzy Hash: f6d5f6f74aca4813406220e93ac092d3ea3d90d5a024274672e554b65dd5b593
Instruction Fuzzy Hash: 8921C172B15B4585EF64DFA6E45026923A5EBC8FC4F194435DE0D97759DF2CE4008780

Function 00007FFD9390E5E0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-3 ref: 00007FFD9390E62B
OPENSSL_LH_retrieve.LIBCRYPTO-3 ref: 00007FFD9390E640
OPENSSL_LH_delete.LIBCRYPTO-3 ref: 00007FFD9390E659
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFD9390E682

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: D_unlockD_write_lockH_deleteH_retrieve
String ID:
API String ID: 3040165603-0
Opcode ID: 0d87fcf42db8673e3f88437e4a9e79d483f35fda6575fe151577583f46c793ef
Instruction ID: 111c9512fcbd2e2a48cfec1fcbf8af71c6f2825990b8f6e66c0e6d9e8f9f92b0
Opcode Fuzzy Hash: 0d87fcf42db8673e3f88437e4a9e79d483f35fda6575fe151577583f46c793ef
Instruction Fuzzy Hash: B1219365F1AB9255EB64BB92A52037DA398BF84FC4F081131EE4D67B89CF3CD4408700

Function 00007FFD9392E0C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9392E10A
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9392E138

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFD9392E0F6, 00007FFD9392E12B

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions.c
API String ID: 2581946324-1165805907
Opcode ID: 4721d8e21139d140ba5e5aeca6091ef62695f224bc40ffbc63c354977b575d49
Instruction ID: 9d6773092e8f391e8724b12ca72c175b2733b96e4841890ccbcd9c3d86b10020
Opcode Fuzzy Hash: 4721d8e21139d140ba5e5aeca6091ef62695f224bc40ffbc63c354977b575d49
Instruction Fuzzy Hash: 1C01F4B6B04B4185D7509F55E8503AA73A8EB45F88F58403ADF4D07B9ADE3CC485C724

Function 00007FFD938EF060 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3(?,00007FFD938ED5CE), ref: 00007FFD938EF095
CRYPTO_memdup.LIBCRYPTO-3(?,00007FFD938ED5CE), ref: 00007FFD938EF0D0

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFD938EF081, 00007FFD938EF0C3

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\s3_lib.c
API String ID: 3962629258-4238427508
Opcode ID: b3154613f53ef167ab7daa8a0e1c38d679cf26e8b6900d9a2b3324e2e10337e5
Instruction ID: e218e93dd93f24cb85552f77cb99eda705e3f997386ae0595f0bc3d4ce67af15
Opcode Fuzzy Hash: b3154613f53ef167ab7daa8a0e1c38d679cf26e8b6900d9a2b3324e2e10337e5
Instruction Fuzzy Hash: 6D014431B1AB8151EBA9DB95E4503E9A394FF48BC4F484031EF5C57B49DF2DE5A18700

Function 00007FFD938E23E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390DC15
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD9390DC40

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFD9390DC01, 00007FFD9390DC33

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\ssl_sess.c
API String ID: 3962629258-2868363209
Opcode ID: 83ba57ea2f63e5d25bc25b3a12f57e5ab8c16677182ba9d2e40e584531579eb6
Instruction ID: f0e707e41100f541fbbcb05173af6a09f26d474a0f4924c739c02bbe9bc0c062
Opcode Fuzzy Hash: 83ba57ea2f63e5d25bc25b3a12f57e5ab8c16677182ba9d2e40e584531579eb6
Instruction Fuzzy Hash: 0E01C429B09F9191E7A18B96E4603A96398FF48FC4F084130EE5D67B89DE2CD5828700

Function 00007FFD939522F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93952327
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD93952350

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FFD93952317, 00007FFD93952340

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\a\1\s\include\internal/packet.h
API String ID: 3962629258-2521442236
Opcode ID: a85e3e8a24e4eeb428877a109fc4a13ce6daae351462691f4826fbe199c60bae
Instruction ID: 5d31aa7b2df22b7ec84acddeba3f8729d0dd535fd635aa46b43dc7c1ce8fa05d
Opcode Fuzzy Hash: a85e3e8a24e4eeb428877a109fc4a13ce6daae351462691f4826fbe199c60bae
Instruction Fuzzy Hash: 9A012132716B4191E7609F82F89065A63A8FB58BC0F088431EF8D57B45DE3CD5518700

Function 00007FFD939310C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939310F7
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD93931120

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FFD939310E7, 00007FFD93931110

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\a\1\s\include\internal/packet.h
API String ID: 3962629258-2521442236
Opcode ID: 5c9a391c5fce4b3c39c833a93ec03fc47235617262c5e6ce7e8a3ffd3ad7be05
Instruction ID: c21059a90d670b6f06fa4d062ea21170f491a3afbd38cf5c36206ae9d050adda
Opcode Fuzzy Hash: 5c9a391c5fce4b3c39c833a93ec03fc47235617262c5e6ce7e8a3ffd3ad7be05
Instruction Fuzzy Hash: BA014F32716B4291EB60DF82F89069A73A8FB58BC0F488431EF8C57B59EE3CD5518700

Function 00007FFD939380A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939380D7
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FFD93938100

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FFD939380C7, 00007FFD939380F0

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\a\1\s\include\internal/packet.h
API String ID: 3962629258-2521442236
Opcode ID: 7a12c30d039aab29ca18a9a7f49df08bc5c3acf6ca22f1b678d7b131251c0348
Instruction ID: bc85544a13020720a5dc63645be158cca174117efcbbcbd0d68bccbb4b9558da
Opcode Fuzzy Hash: 7a12c30d039aab29ca18a9a7f49df08bc5c3acf6ca22f1b678d7b131251c0348
Instruction Fuzzy Hash: 8A012C3271AB4291EB609F82E89069A6368FB58BC0F088431EF8C57B45EE3CD5518700

Function 00007FFD9393F660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3(?,00007FFD939461CB), ref: 00007FFD9393F697
CRYPTO_memdup.LIBCRYPTO-3(?,00007FFD939461CB), ref: 00007FFD9393F6C0

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FFD9393F687, 00007FFD9393F6B0

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\a\1\s\include\internal/packet.h
API String ID: 3962629258-2521442236
Opcode ID: b1ba4f676e7cba9f2f2b58de4d4b341a4c05a7496b7e0e1d6a7617de362f3e5d
Instruction ID: 1afc19e4737178c5eeb0287965e949a705cf3e351d9f1ad4b6a566af19a619a0
Opcode Fuzzy Hash: b1ba4f676e7cba9f2f2b58de4d4b341a4c05a7496b7e0e1d6a7617de362f3e5d
Instruction Fuzzy Hash: 58014F32716B4291EB60DF82F89069A7368FB58BC0F088431EF8D57B55EE3CD5518700

Function 00007FFD938F14E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3(00000000,00007FFD938F0BB6), ref: 00007FFD938F150E
CRYPTO_strndup.LIBCRYPTO-3(00000000,00007FFD938F0BB6), ref: 00007FFD938F1531

Strings

..\s\ssl\ssl_asn1.c, xrefs: 00007FFD938F1501, 00007FFD938F1520

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_strndup
String ID: ..\s\ssl\ssl_asn1.c
API String ID: 2641571835-3659835543
Opcode ID: b4a55b767f0d97bc12d72e71db74bbd55fe75f9d40200b1de7e2156741271c11
Instruction ID: 5bce7cb9a6ab2437036f6ace990809779ee619458576487c499219c884dc2eb1
Opcode Fuzzy Hash: b4a55b767f0d97bc12d72e71db74bbd55fe75f9d40200b1de7e2156741271c11
Instruction Fuzzy Hash: 2B01A232B1AB4181EB609B95F5503696364FB48FC4F084032FE4DA3B49DE2CD5A08700

Function 00007FFD938E271B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9390DA4D
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FFD9390DA7E

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FFD9390DA40, 00007FFD9390DA74

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_strdup
String ID: ..\s\ssl\ssl_sess.c
API String ID: 2148955802-2868363209
Opcode ID: b911845fcac4a3d6a282408cb186a3f15c2fc6447c8482edd65e0f2285ed320a
Instruction ID: f6cc96cda14265f7a666a22ab03631b672a6ab35de5205c02fcf9b5ce49dfa8a
Opcode Fuzzy Hash: b911845fcac4a3d6a282408cb186a3f15c2fc6447c8482edd65e0f2285ed320a
Instruction Fuzzy Hash: 53F02825B1C60292EB69CB9AF5503A86359FF8CBC0F4C8031ED0C53B86EF2CD2918700

Function 00007FFD93938350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93938379
CRYPTO_strndup.LIBCRYPTO-3 ref: 00007FFD93938392

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FFD9393836F, 00007FFD93938382

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_strndup
String ID: D:\a\1\s\include\internal/packet.h
API String ID: 2641571835-2521442236
Opcode ID: 3225c35bf251e626e4139bc26850fbb057844e1e254e5c67df70bb6ce82af30e
Instruction ID: b2aab3f7401e6a4f2b336b6861500f969a0b11511d0aedb68449522f957b7646
Opcode Fuzzy Hash: 3225c35bf251e626e4139bc26850fbb057844e1e254e5c67df70bb6ce82af30e
Instruction Fuzzy Hash: 81F0A036B19A4290EB14AB92F8A56ED2324EB4CBC4F448032EE4D97799DE2CC6958700

Function 00007FFD939286D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFD939286F9
CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD93928712

Strings

..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FFD93928705

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_cleanseO_free
String ID: ..\s\ssl\record\ssl3_buffer.c
API String ID: 4015144264-837614940
Opcode ID: 21cc41989528223854c270181327ac9470844c24f6d2dda4b5d884cfa4c49853
Instruction ID: 4d6c54de27940a48e1b5d75e4cae0be8a85e6ef773850fe7df16edf94357265d
Opcode Fuzzy Hash: 21cc41989528223854c270181327ac9470844c24f6d2dda4b5d884cfa4c49853
Instruction Fuzzy Hash: 4EE06D96B06A8190F760A7E9D4A9BA81754AB44B88F080230DD0C4F396DE5AD586C700

Function 00007FFD938E1771 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939287AA

Strings

..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FFD9392879D

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\record\ssl3_buffer.c
API String ID: 2581946324-837614940
Opcode ID: 528cfb638c9265073da1d96b2b7a73e07ff011cef3c8649fec17129e0635ca34
Instruction ID: 3ac06f799e8421932d1d3e4809a6ec7b711dd025d68e267afef2ac6c383af7a2
Opcode Fuzzy Hash: 528cfb638c9265073da1d96b2b7a73e07ff011cef3c8649fec17129e0635ca34
Instruction Fuzzy Hash: 6C016176B18F6192E7709B94E5503AAB368FB44F94F280231EA4C27A49DF29D951C740

Function 00007FFD938E1140 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD938E4FA0: CRYPTO_free.LIBCRYPTO-3(?,?,?,?,?,00007FFD938E412F), ref: 00007FFD938E5094

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938E4146

Strings

..\s\crypto\packet.c, xrefs: 00007FFD938E4139

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free
String ID: ..\s\crypto\packet.c
API String ID: 2581946324-3021818708
Opcode ID: 99ba739f443f253d83b52741c5b42f0a1eb09f90533206538d320439f766422f
Instruction ID: 492ae7f6f7680e241b94a7c2fd356c62d14e0ffa3d10c9f435865ea2ae9cebf7
Opcode Fuzzy Hash: 99ba739f443f253d83b52741c5b42f0a1eb09f90533206538d320439f766422f
Instruction Fuzzy Hash: 0FF0BBA5B1460281EF75ABA6E85037B13A9FF94B94F541030E90C57785DF6DD8D1C700

Function 00007FFD939252A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939252E3

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFD939252D6

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 2581946324-1306860146
Opcode ID: a0ea09f7b4caa632463648e6a5a3eac89013ff4ec3887a629b3c32d42dcac195
Instruction ID: e4fe91441f5936e09a1b7a73b38d415757f3f9390ab1d1062afed245a5bc68d4
Opcode Fuzzy Hash: a0ea09f7b4caa632463648e6a5a3eac89013ff4ec3887a629b3c32d42dcac195
Instruction Fuzzy Hash: FAF0E211B1860281EF74BB96F8613BD8354AF88BC4F481030FE0D1BB8BDD2CD8908700

Function 00007FFD938F4790 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CRYPTO_get_ex_new_index.LIBCRYPTO-3 ref: 00007FFD938F47B8

Strings

SSL for verify callback, xrefs: 00007FFD938F479F

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_get_ex_new_index
String ID: SSL for verify callback
API String ID: 3987194240-2900698531
Opcode ID: 59c0670782c922fdc27d721ea8a6a82999326f5914611dc9f031e502ee468eac
Instruction ID: e9eb49e65ba76ea9cecb97d994da76c62dd7d7f4fbca8de7a4823804cf2d4d4a
Opcode Fuzzy Hash: 59c0670782c922fdc27d721ea8a6a82999326f5914611dc9f031e502ee468eac
Instruction Fuzzy Hash: 68E01271F0564296E331EBE4E851AA637E9BB94304F414235E58C93761EF3DE155CB40

Function 00007FFD938ED2E1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD938ED2F5

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFD938ED2E8

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\s3_lib.c
API String ID: 2581946324-4238427508
Opcode ID: 6350cf16a9c0d126380f3fa9b0e1836d1dc1cf503f95eea3ecfac14a546e38b6
Instruction ID: 9ec569082ca9fd1f5e83aae55ce2a2be88254fd0dd59fa1a7bfd739e1d8edbff
Opcode Fuzzy Hash: 6350cf16a9c0d126380f3fa9b0e1836d1dc1cf503f95eea3ecfac14a546e38b6
Instruction Fuzzy Hash: A0E08626708B4180E750AB99F4403986319E781BE8F084032DF0C0BA49CE79D4D69711

Function 00007FFD9392E260 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9392E286

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFD9392E272

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions.c
API String ID: 2581946324-1165805907
Opcode ID: 496e81ba4a152e5f5996a1ac003a677bc8841543c4498346642b06517555573c
Instruction ID: 8a5b428d702aa96672da325dd3fa1a4b20cb9348da2cfbd0aa12442896740517
Opcode Fuzzy Hash: 496e81ba4a152e5f5996a1ac003a677bc8841543c4498346642b06517555573c
Instruction Fuzzy Hash: C6E012A6B056408AE795A7A5D8153D52398FB48B44F840130ED4DC7781EF5982918710

Function 00007FFD9392E200 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD9392E226

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFD9392E212

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions.c
API String ID: 2581946324-1165805907
Opcode ID: 19486f1f70c6fc214faf183a925b9ec0f1369ca687dbcddd0267e641ce2128b8
Instruction ID: 2886cc445b7953e85629586336b6cc6ead7ee1a08bc5894a487990c40858a2c7
Opcode Fuzzy Hash: 19486f1f70c6fc214faf183a925b9ec0f1369ca687dbcddd0267e641ce2128b8
Instruction Fuzzy Hash: 90E012A5B017405AE7D1A7A5D8553D5239CEB49F44F540031DD4DC7782ED5982D18710

Function 00007FFD938EB200 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FFD938EB22D

Strings

..\s\ssl\s3_enc.c, xrefs: 00007FFD938EB216

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_clear_free
String ID: ..\s\ssl\s3_enc.c
API String ID: 2011826501-1839494539
Opcode ID: a3fd00c98839b7e8c1664afbc487672423ed4b4892010f20281f31aa65610e19
Instruction ID: 77cc80f0dbc48c89743763143d0c612d246200e30bee8f5b69ff4d829da0b65d
Opcode Fuzzy Hash: a3fd00c98839b7e8c1664afbc487672423ed4b4892010f20281f31aa65610e19
Instruction Fuzzy Hash: CCE08C72B06B4582D791ABA5E8143D823A8EB0CB48F480031E90C9B351EE28C3938380

Function 00007FFD938E107D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FFD939179A4

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFD9391799D

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\t1_lib.c
API String ID: 2581946324-1643863364
Opcode ID: b393b900e37ea5ef3f3a429c33ed7b3b8c7153a8668125abedf165aa69c8d630
Instruction ID: 43c7c4aa189cc7ca1426fcafd206f035a90031ce796f70e9c18290dd8d63b9f3
Opcode Fuzzy Hash: b393b900e37ea5ef3f3a429c33ed7b3b8c7153a8668125abedf165aa69c8d630
Instruction Fuzzy Hash: B3D05E11F19106A1EB74B7D6D8617FC2328EB89F40F540131ED1E67B92DD1DA68A9700

Function 00007FFD938E267B Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-3 ref: 00007FFD93903C00
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFD93903C22

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: 684068de0249cd697c2edab7a9c605427e68fc8da4ae45c78f9a4853c1631537
Instruction ID: cb385a0a6862250fd56027798b0ebf608e59859284d69ac0fb52c556f9c0a485
Opcode Fuzzy Hash: 684068de0249cd697c2edab7a9c605427e68fc8da4ae45c78f9a4853c1631537
Instruction Fuzzy Hash: 95E06526B1D68291E760A796F5917BC5358EB88BC4F481030FE0D97796DE18D5D18600

Function 00007FFD938FE227 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-3 ref: 00007FFD938FE260
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FFD938FE282

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: dba52de233cc2b69350f587698fd3148d50166bd7fb018036490d9ced0c3ceee
Instruction ID: e7561f07b86a9970f1a29c6a98c93c3ede09bab54290233e9494564d3cbff39f
Opcode Fuzzy Hash: dba52de233cc2b69350f587698fd3148d50166bd7fb018036490d9ced0c3ceee
Instruction Fuzzy Hash: 0FD02B52F0818242EB5467D2FC542E55358AF4CBC8F180130FE0C83FA6FD1CCA914700

Function 00007FFD938F21F0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_run_once.LIBCRYPTO-3 ref: 00007FFD938F220B

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: D_run_once
String ID:
API String ID: 1403826838-0
Opcode ID: 001cd4771d6f2b870f5e2e680b4ac14c104d7506a7621e2cc91e670adcdf643c
Instruction ID: ff95b0880af677d50defd50024d7369b813d9a58b785501f80a4defd1ca315ae
Opcode Fuzzy Hash: 001cd4771d6f2b870f5e2e680b4ac14c104d7506a7621e2cc91e670adcdf643c
Instruction Fuzzy Hash: 04E08C24F09103A6FB78BBA8E8B17722398AF80310F804235E42DA26E1DE1DF9008740

Function 00007FFD938E12CB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_run_once.LIBCRYPTO-3 ref: 00007FFD938F552B

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: D_run_once
String ID:
API String ID: 1403826838-0
Opcode ID: 3967ec2dced1998402e64a30c320066bae59fdba63e2d9367f86d3e407c5ac3e
Instruction ID: 11b8cecfc6de6e2f570707b8b7a91d1988c00e3bde0e656e70e88dee9929fbdb
Opcode Fuzzy Hash: 3967ec2dced1998402e64a30c320066bae59fdba63e2d9367f86d3e407c5ac3e
Instruction Fuzzy Hash: F7D0C954F19607A1FA707BE8E8716B4271CAF80300FC04132D02D263A2EE1DEA5A8780

Function 00007FFD938E22DE Relevance: 52.7, APIs: 26, Strings: 4, Instructions: 198COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD938EB599
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD938EB5B1
ERR_new.LIBCRYPTO-3 ref: 00007FFD938EB636
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938EB644
BIO_free.LIBCRYPTO-3 ref: 00007FFD938EB667
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFD938EB67C
EVP_MD_get_type.LIBCRYPTO-3 ref: 00007FFD938EB684
ERR_new.LIBCRYPTO-3 ref: 00007FFD938EB68E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938EB6A6
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD938EB6C6
ERR_new.LIBCRYPTO-3 ref: 00007FFD938EB6D3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938EB6EB
EVP_MD_CTX_copy_ex.LIBCRYPTO-3 ref: 00007FFD938EB716
ERR_new.LIBCRYPTO-3 ref: 00007FFD938EB71F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938EB811
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD938EB830

Strings

ssl3_final_finish_mac, xrefs: 00007FFD938EB693, 00007FFD938EB6D8, 00007FFD938EB803
ssl3_digest_cached_records, xrefs: 00007FFD938EB625
ssl3-ms, xrefs: 00007FFD938EB763
..\s\ssl\s3_enc.c, xrefs: 00007FFD938EB62C, 00007FFD938EB69F, 00007FFD938EB6E4, 00007FFD938EB80A

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$X_new$D_get_typeO_ctrlO_freeX_copy_exX_freeX_get0_md
String ID: ..\s\ssl\s3_enc.c$ssl3-ms$ssl3_digest_cached_records$ssl3_final_finish_mac
API String ID: 2271831671-3843019499
Opcode ID: 28829e7003b49d550aa7c24b3b1eb25afb19786f97720025772459f8810b2b3f
Instruction ID: f4acb82283697fb67da7ae2648f463db38831ea33d7fce14cab0245d310c01d3
Opcode Fuzzy Hash: 28829e7003b49d550aa7c24b3b1eb25afb19786f97720025772459f8810b2b3f
Instruction Fuzzy Hash: 5081AF26B0C746A1FA35ABE698717FA239CAF95784F404031DD4E776A2EE3CE5818740

Function 00007FFD9391B510 Relevance: 45.8, APIs: 16, Strings: 10, Instructions: 294COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FFD9391B63A
BIO_printf.LIBCRYPTO-3 ref: 00007FFD9391B64C
BIO_indent.LIBCRYPTO-3 ref: 00007FFD9391B671
BIO_printf.LIBCRYPTO-3 ref: 00007FFD9391B6AB
BIO_indent.LIBCRYPTO-3 ref: 00007FFD9391B742
BIO_printf.LIBCRYPTO-3 ref: 00007FFD9391B754
BIO_indent.LIBCRYPTO-3 ref: 00007FFD9391B78E
BIO_printf.LIBCRYPTO-3 ref: 00007FFD9391B7D1
BIO_indent.LIBCRYPTO-3 ref: 00007FFD9391B81F
BIO_printf.LIBCRYPTO-3 ref: 00007FFD9391B852
BIO_indent.LIBCRYPTO-3 ref: 00007FFD9391B8A6
BIO_printf.LIBCRYPTO-3 ref: 00007FFD9391B8B8
d2i_X509_NAME.LIBCRYPTO-3 ref: 00007FFD9391B8CC
BIO_puts.LIBCRYPTO-3 ref: 00007FFD9391B8E3
BIO_puts.LIBCRYPTO-3 ref: 00007FFD9391B905
X509_NAME_free.LIBCRYPTO-3 ref: 00007FFD9391B90D

Part of subcall function 00007FFD9391DBC0: BIO_printf.LIBCRYPTO-3(?,00007FFD9391B04A), ref: 00007FFD9391DC04
Part of subcall function 00007FFD9391DBC0: BIO_printf.LIBCRYPTO-3(?,00007FFD9391B04A), ref: 00007FFD9391DC1F

Part of subcall function 00007FFD9391D2E0: BIO_indent.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9391B5F8), ref: 00007FFD9391D327
Part of subcall function 00007FFD9391D2E0: BIO_puts.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9391B5F8), ref: 00007FFD9391D33B

Strings

%s (%d), xrefs: 00007FFD9391B6A1
<UNPARSEABLE DN>, xrefs: 00007FFD9391B8DC
DistinguishedName (len=%d): , xrefs: 00007FFD9391B8AE
signature_algorithms (len=%d), xrefs: 00007FFD9391B74A
certificate_types (len=%d), xrefs: 00007FFD9391B642
request_context, xrefs: 00007FFD9391B597
%s (0x%04x), xrefs: 00007FFD9391B7C7
certificate_authorities (len=%d), xrefs: 00007FFD9391B838
UNKNOWN, xrefs: 00007FFD9391B691, 00007FFD9391B7BA
request_extensions, xrefs: 00007FFD9391B982

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_printf$O_indent$O_puts$X509_$E_freed2i_
String ID: %s (%d)$%s (0x%04x)$<UNPARSEABLE DN>$DistinguishedName (len=%d): $UNKNOWN$certificate_authorities (len=%d)$certificate_types (len=%d)$request_context$request_extensions$signature_algorithms (len=%d)
API String ID: 2542938528-1289818360
Opcode ID: e5ec8d1f2492826789591e9dd6ff3efe46afef87edda0d890920d62b1aa0631b
Instruction ID: 7dce7674f88350256e461a01b32ea7e75bfff4894e5d58cd09ecc800e0a19ca3
Opcode Fuzzy Hash: e5ec8d1f2492826789591e9dd6ff3efe46afef87edda0d890920d62b1aa0631b
Instruction Fuzzy Hash: DDC11726B1869169EB309BA6D4257B96B9AFB89BD4F488031DD8E33B91CF3CD541C700

Function 00007FFD938E169A Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 209COMMON

Download Yara Rule

APIs

EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFD93929B7E
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFD93929B86
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FFD93929BBB
EVP_CIPHER_get_mode.LIBCRYPTO-3 ref: 00007FFD93929BC3
memcpy.VCRUNTIME140 ref: 00007FFD93929BF1
memcpy.VCRUNTIME140 ref: 00007FFD93929C08
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFD93929C38
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD93929C97
EVP_MD_CTX_copy_ex.LIBCRYPTO-3 ref: 00007FFD93929CC6
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD93929CDE
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD93929CF8
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD93929D11
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD93929D2C
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD93929D45
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD93929D5D
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FFD93929D73
EVP_MD_CTX_copy_ex.LIBCRYPTO-3 ref: 00007FFD93929D82
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD93929D96
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD93929DAC
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD93929DC0
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FFD93929DD4
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD93929DE0
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD93929DF7

Strings

666666666666666666666666666666666666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\, xrefs: 00007FFD93929C01, 00007FFD93929CEE

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: Digest$Update$Final_exX_copy_exX_freeX_get0_mdmemcpy$D_get_sizeR_get_modeX_get0_cipherX_new
String ID: 666666666666666666666666666666666666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
API String ID: 1783088893-2009547811
Opcode ID: 701d8d5d429757265722fa2fc4d025157dc7f0f81d7d3be07cd8f14bfebaa94f
Instruction ID: 494334a509577df5696045b028bd02a9c39b5b994c576222da36090b505954ea
Opcode Fuzzy Hash: 701d8d5d429757265722fa2fc4d025157dc7f0f81d7d3be07cd8f14bfebaa94f
Instruction Fuzzy Hash: D681D756B08BC351EA34E7EAA8B57BA5799AF46BC4F040035ED4E67796DE2CE041C700

Function 00007FFD93911250 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 214COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD939127C0), ref: 00007FFD93911315
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD939127C0), ref: 00007FFD93911333
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD939127C0), ref: 00007FFD93911358
ERR_set_error.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD939127C0), ref: 00007FFD93911369
EVP_MD_get0_name.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD939127C0), ref: 00007FFD939113C5
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD939127C0), ref: 00007FFD93911440
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD939127C0), ref: 00007FFD93911472
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD939127C0), ref: 00007FFD939114A6
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD939127C0), ref: 00007FFD939114DA
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3(?,?,?,?,00000020,?,?,00007FFD939127C0), ref: 00007FFD93911511

Strings

TLS1-PRF, xrefs: 00007FFD9391137C
..\s\ssl\t1_enc.c, xrefs: 00007FFD93911321, 00007FFD939115A2
digest, xrefs: 00007FFD939113CD
seed, xrefs: 00007FFD93911418, 00007FFD9391144A, 00007FFD9391147C, 00007FFD939114B0, 00007FFD939114E4
secret, xrefs: 00007FFD939113E6
tls1_PRF, xrefs: 00007FFD9391131A, 00007FFD9391159B

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: M_construct_octet_string$R_set_debug$D_get0_nameR_newR_set_error
String ID: ..\s\ssl\t1_enc.c$TLS1-PRF$digest$secret$seed$tls1_PRF
API String ID: 2018442406-343031646
Opcode ID: 66a3d005abe625f1938974e1217084bca44be8e60b87a58ccbf077f9680b8d71
Instruction ID: e59ff05a914310180918e5566949e2c012f25b6a20336fae53ea6d307f13e929
Opcode Fuzzy Hash: 66a3d005abe625f1938974e1217084bca44be8e60b87a58ccbf077f9680b8d71
Instruction Fuzzy Hash: 24B18126A08BC6A5E721DFA4D8613F96764FB99788F005132EE4D27756EF38E2C4C740

Function 00007FFD938E20CC Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD938EBF30
ERR_new.LIBCRYPTO-3 ref: 00007FFD938EBF48
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938EBF60
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FFD938EBFB4
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD938EBFEC
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD938EC002
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD938EC01F
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD938EC03C
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FFD938EC056
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FFD938EC077
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD938EC089
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD938EC09F
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FFD938EC0B3
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD938EC0D8
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFD938EC0E7

Strings

ssl3_generate_master_secret, xrefs: 00007FFD938EBF4D, 00007FFD938EC0FB
..\s\ssl\s3_enc.c, xrefs: 00007FFD938EBF59, 00007FFD938EC107

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: Digest$Update$Final_exInit_ex$L_cleanseR_newR_set_debugX_freeX_new
String ID: ..\s\ssl\s3_enc.c$ssl3_generate_master_secret
API String ID: 284231625-143700668
Opcode ID: 97b96a8955ac91748196cad49aebfd042e64ceb6521c498ffc10a7203c6c4ea9
Instruction ID: d537862d6833d702d6e6651832d9dcfe771237b19f4715d3c5ca469943b95858
Opcode Fuzzy Hash: 97b96a8955ac91748196cad49aebfd042e64ceb6521c498ffc10a7203c6c4ea9
Instruction Fuzzy Hash: FF51D365B1C78352EA38ABE6E9617BA6398BF85BC4F401031ED4D67756DE3DE0418B00

Function 00007FFD938E2513 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3 ref: 00007FFD93909B67
BIO_new.LIBCRYPTO-3 ref: 00007FFD93909B6F
ERR_new.LIBCRYPTO-3 ref: 00007FFD93909B7C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93909B92
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD93909BB0
ERR_new.LIBCRYPTO-3 ref: 00007FFD93909BB9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93909BD1
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93909CC7
X509_free.LIBCRYPTO-3 ref: 00007FFD93909CD1
BIO_free.LIBCRYPTO-3 ref: 00007FFD93909CD9

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFD93909B8B, 00007FFD93909BCA, 00007FFD93909BF9, 00007FFD93909C39, 00007FFD93909CB2
SSL_CTX_use_certificate_file, xrefs: 00007FFD93909B81, 00007FFD93909BBE, 00007FFD93909BED, 00007FFD93909C2D, 00007FFD93909CA6

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$O_ctrlO_freeO_newO_s_fileR_set_errorX509_free
String ID: ..\s\ssl\ssl_rsa.c$SSL_CTX_use_certificate_file
API String ID: 2680622528-1162081224
Opcode ID: 4ed96199b7cab44813e0d3618d52d3fe48afe7b6b130c28909c4744ee33e188e
Instruction ID: 665aa0796460367d496edb5f84ce556e30929ba7bd12331807cad9971cf0efec
Opcode Fuzzy Hash: 4ed96199b7cab44813e0d3618d52d3fe48afe7b6b130c28909c4744ee33e188e
Instruction Fuzzy Hash: FB418F69F0D742A1FA30ABD5E8213BE2399AF85790F504032ED4D277A6DE3CE485CB40

Function 00007FFD9391E1F0 Relevance: 35.2, APIs: 7, Strings: 13, Instructions: 248COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9391D7CC), ref: 00007FFD9391E23B
BIO_indent.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9391D7CC), ref: 00007FFD9391E3E7
BIO_puts.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9391D7CC), ref: 00007FFD9391E3FD
BIO_puts.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9391D7CC), ref: 00007FFD9391E415
BIO_printf.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9391D7CC), ref: 00007FFD9391E24F

Part of subcall function 00007FFD9391DBC0: BIO_printf.LIBCRYPTO-3(?,00007FFD9391B04A), ref: 00007FFD9391DC04
Part of subcall function 00007FFD9391DBC0: BIO_printf.LIBCRYPTO-3(?,00007FFD9391B04A), ref: 00007FFD9391DC1F

Strings

explicit_char2, xrefs: 00007FFD9391E40B
rsa_exponent, xrefs: 00007FFD9391E55B
psk_identity_hint, xrefs: 00007FFD9391E2A5
explicit_prime, xrefs: 00007FFD9391E3F3
dh_g, xrefs: 00007FFD9391E383
point, xrefs: 00007FFD9391E4A4
dh_p, xrefs: 00007FFD9391E335
UNKNOWN, xrefs: 00007FFD9391E462
rsa_modulus, xrefs: 00007FFD9391E522
KeyExchangeAlgorithm=%s, xrefs: 00007FFD9391E245
dh_Ys, xrefs: 00007FFD9391E3C4
named_curve: %s (%d), xrefs: 00007FFD9391E46F
UNKNOWN CURVE PARAMETER TYPE %d, xrefs: 00007FFD9391E4CC

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_printf$O_indentO_puts
String ID: KeyExchangeAlgorithm=%s$UNKNOWN$UNKNOWN CURVE PARAMETER TYPE %d$dh_Ys$dh_g$dh_p$explicit_char2$explicit_prime$named_curve: %s (%d)$point$psk_identity_hint$rsa_exponent$rsa_modulus
API String ID: 3310571797-1380109711
Opcode ID: 47121956bf6636675cfb9b2e70c2587bc754de3f6f9d9fe41b36e48461540114
Instruction ID: cf5259a56c233e6fae1350417d0f95037d9d5750796d2329b231f7a52ee5bcff
Opcode Fuzzy Hash: 47121956bf6636675cfb9b2e70c2587bc754de3f6f9d9fe41b36e48461540114
Instruction Fuzzy Hash: 4BA1B122F08696A5EA34CB95E4253EAB76AFB49780F444132DE9E33B84DF3CE515C300

Function 00007FFD938E109B Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

OPENSSL_sk_new.LIBCRYPTO-3 ref: 00007FFD9394D86C
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394D87B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394D893
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFD9394D95E
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD9394D97A
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD9394DA5A
X509_NAME_free.LIBCRYPTO-3 ref: 00007FFD9394DA62

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD9394D88C, 00007FFD9394D9B0, 00007FFD9394D9D5, 00007FFD9394D9FA, 00007FFD9394DA2E
parse_ca_names, xrefs: 00007FFD9394D885, 00007FFD9394D9A4, 00007FFD9394D9C9, 00007FFD9394D9EE, 00007FFD9394DA22

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_pop_free$E_freeL_sk_newL_sk_pushR_newR_set_debugX509_
String ID: ..\s\ssl\statem\statem_lib.c$parse_ca_names
API String ID: 3454744561-1744826974
Opcode ID: 034a734ff06d8d1b3df841fcb18ccceef9552ac6a6de163322302505e8d318e0
Instruction ID: 0c0195acf46ad26ec21c9ad889df536ae4f6bae1e7966fcf342828b0966d47c9
Opcode Fuzzy Hash: 034a734ff06d8d1b3df841fcb18ccceef9552ac6a6de163322302505e8d318e0
Instruction Fuzzy Hash: C1517069F0D69275FB70ABE5D4253BA2359AF84780F544032DE8D636D3DE3CE5818B40

Function 00007FFD938F0070 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD938F00A6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938F00BE
EVP_PKEY_CTX_new_from_name.LIBCRYPTO-3 ref: 00007FFD938F00F1
ERR_new.LIBCRYPTO-3 ref: 00007FFD938F00FE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938F0116
EVP_PKEY_CTX_free.LIBCRYPTO-3 ref: 00007FFD938F0214

Strings

ssl_generate_pkey_group, xrefs: 00007FFD938F00AB, 00007FFD938F0103, 00007FFD938F0145, 00007FFD938F018C, 00007FFD938F01D1
..\s\ssl\s3_lib.c, xrefs: 00007FFD938F00B7, 00007FFD938F010F, 00007FFD938F0151, 00007FFD938F0198, 00007FFD938F01DD

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$X_freeX_new_from_name
String ID: ..\s\ssl\s3_lib.c$ssl_generate_pkey_group
API String ID: 3722767420-2496621805
Opcode ID: 04cb3ac14babf414ab54659c1420eb3a9ddd0205a92f5e3455bd0f86b5a8a258
Instruction ID: 2bff03b507a33a31178df1f9dee9788ead376653f8be8535968b52710315147d
Opcode Fuzzy Hash: 04cb3ac14babf414ab54659c1420eb3a9ddd0205a92f5e3455bd0f86b5a8a258
Instruction Fuzzy Hash: 0741BE29B1E742A5E774E7E1E8717FA2319AF95780F400032ED4D63692DE3DE844C740

Function 00007FFD93909680 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3 ref: 00007FFD939096AE
BIO_new.LIBCRYPTO-3 ref: 00007FFD939096B6
ERR_new.LIBCRYPTO-3 ref: 00007FFD939096C3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939096DB
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD939096F9
ERR_new.LIBCRYPTO-3 ref: 00007FFD93909702
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390971A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD939097EF
BIO_free.LIBCRYPTO-3 ref: 00007FFD939097F7

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFD939096D4, 00007FFD93909713, 00007FFD9390979A, 00007FFD939097D7
SSL_CTX_use_PrivateKey_file, xrefs: 00007FFD939096C8, 00007FFD93909707, 00007FFD9390978E, 00007FFD939097CB

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$O_ctrlO_freeO_newO_s_fileR_set_error
String ID: ..\s\ssl\ssl_rsa.c$SSL_CTX_use_PrivateKey_file
API String ID: 1899708915-2252211958
Opcode ID: d94c28d24c7e937970c451ff150ad84ccb53ce58e2228629b3f1025ff047b185
Instruction ID: 010fa5548d404a7ffdebfc6adea04b32dc8d8805c1c26e4d8f090fadd090db29
Opcode Fuzzy Hash: d94c28d24c7e937970c451ff150ad84ccb53ce58e2228629b3f1025ff047b185
Instruction Fuzzy Hash: C341716AB0DB42A1E770ABE5D8213FA6359AF88B80F544032ED4D377A6DE3CE5418741

Function 00007FFD938E2216 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9393B92D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393B945
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393B9DE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393B9F6
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393BA17
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393BA2F
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393BC2D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393BC45

Strings

tls_parse_ctos_key_share, xrefs: 00007FFD9393B932, 00007FFD9393B9E3, 00007FFD9393BA21, 00007FFD9393BBC3, 00007FFD9393BBED, 00007FFD9393BC37
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD9393B93E, 00007FFD9393B9EF, 00007FFD9393BA28, 00007FFD9393BBCF, 00007FFD9393BBF9, 00007FFD9393BC3E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_key_share
API String ID: 193678381-166674739
Opcode ID: 0fe6995ea354464c5bc0c7b3a42a95ee06481d772f92f80e0ea7575255af8488
Instruction ID: 3f048a76d4d1d455db3df83ef7c25e4c902725c9c13e76912bd61439c54afc3f
Opcode Fuzzy Hash: 0fe6995ea354464c5bc0c7b3a42a95ee06481d772f92f80e0ea7575255af8488
Instruction Fuzzy Hash: C691A1A1F0869261F734ABA594243FA67E9EF80784F044132ED5F67ADACF3CE5818740

Function 00007FFD939592D0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,00007FFD9395BC7D), ref: 00007FFD9395933A
ERR_set_debug.LIBCRYPTO-3(?,?,?,00007FFD9395BC7D), ref: 00007FFD93959352
ERR_new.LIBCRYPTO-3(?,?,?,00007FFD9395BC7D), ref: 00007FFD93959368
ERR_set_debug.LIBCRYPTO-3(?,?,?,00007FFD9395BC7D), ref: 00007FFD93959380
ERR_new.LIBCRYPTO-3(?,?,?,00007FFD9395BC7D), ref: 00007FFD9395945C
ERR_set_debug.LIBCRYPTO-3(?,?,?,00007FFD9395BC7D), ref: 00007FFD93959474
EVP_PKEY_free.LIBCRYPTO-3(?,?,?,00007FFD9395BC7D), ref: 00007FFD93959492

Strings

tls_process_cke_dhe, xrefs: 00007FFD9395933F, 00007FFD9395936D, 00007FFD939593D4, 00007FFD93959437, 00007FFD93959461
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD9395934B, 00007FFD93959379, 00007FFD939593E0, 00007FFD93959443, 00007FFD9395946D

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$Y_free
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_cke_dhe
API String ID: 2633058761-3621362005
Opcode ID: 8079ac5babdb914cc97b14bc09e57019c8c556e029d5a52e01bb6db19c09f5b8
Instruction ID: 1aba32194d47deb964a7fbbddd0dc94e7d9661b8571434d4c34a7c6c35b2adb2
Opcode Fuzzy Hash: 8079ac5babdb914cc97b14bc09e57019c8c556e029d5a52e01bb6db19c09f5b8
Instruction Fuzzy Hash: 48415E65B08752A5FB30ABE5E8613BA6359AF41B80F944031DE4E37BD2DF3CE9818740

Function 00007FFD938E20D1 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93933CDD
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93933CF9
i2d_OCSP_RESPID.LIBCRYPTO-3 ref: 00007FFD93933D3C
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93933D52
i2d_X509_EXTENSIONS.LIBCRYPTO-3 ref: 00007FFD93933D92
ERR_new.LIBCRYPTO-3 ref: 00007FFD93933D9E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93933DB6
ERR_new.LIBCRYPTO-3 ref: 00007FFD93933DE8
i2d_X509_EXTENSIONS.LIBCRYPTO-3 ref: 00007FFD93933E1B
ERR_new.LIBCRYPTO-3 ref: 00007FFD93933E24
ERR_new.LIBCRYPTO-3 ref: 00007FFD93933E5C
ERR_new.LIBCRYPTO-3 ref: 00007FFD93933E72
ERR_new.LIBCRYPTO-3 ref: 00007FFD93933E88
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93933EA0

Strings

tls_construct_ctos_status_request, xrefs: 00007FFD93933DA3, 00007FFD93933DED, 00007FFD93933E29, 00007FFD93933E61, 00007FFD93933E77, 00007FFD93933E8D
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93933DAF, 00007FFD93933E99

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$i2d_$L_sk_numR_set_debugX509_$L_sk_value
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_status_request
API String ID: 3024451675-148121689
Opcode ID: d1428318352c6b2745dea5dc192ae58ce7cf3d8c3326f8ea22e30f6ca020501a
Instruction ID: f20326b3dc2c01662db82f1ef6b9e1937fd043e48f720a919924337e82eb9c94
Opcode Fuzzy Hash: d1428318352c6b2745dea5dc192ae58ce7cf3d8c3326f8ea22e30f6ca020501a
Instruction Fuzzy Hash: 0D519E65B0C64362FB78A7E298B13F9139DAF85B84F444031DD0EA7AC6DE2DE9428700

Function 00007FFD938F56E0 Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 101stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD938F5716
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD938F5747
ERR_new.LIBCRYPTO-3 ref: 00007FFD938F57E0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938F57F8
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938F5809

Strings

ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFD938F5833, 00007FFD938F5843
SUITEB128, xrefs: 00007FFD938F576B
ECDHE-ECDSA-AES128-GCM-SHA256, xrefs: 00007FFD938F584F
SUITEB192, xrefs: 00007FFD938F5799
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FFD938F582C
SUITEB128ONLY, xrefs: 00007FFD938F570A
check_suiteb_cipher_list, xrefs: 00007FFD938F57E5
..\s\ssl\ssl_ciph.c, xrefs: 00007FFD938F57F1
SUITEB128C2, xrefs: 00007FFD938F573A

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: strncmp$R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_ciph.c$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192$check_suiteb_cipher_list
API String ID: 1930259724-1099454403
Opcode ID: cd731b4d236905a648258da8a9046f31ad121a3fa299a8f54cbee44a92dc2aeb
Instruction ID: 4586fc4fd652de06683c2274b22265375a0efc01dd521dabd0ecd4ba8399e6b3
Opcode Fuzzy Hash: cd731b4d236905a648258da8a9046f31ad121a3fa299a8f54cbee44a92dc2aeb
Instruction Fuzzy Hash: AF41D376B18A07A6E7308BA5E86037933A8FB44B94F504435EA0DE3794DF3DE960CB40

Function 00007FFD938E16E5 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3 ref: 00007FFD9390A7BE
BIO_new.LIBCRYPTO-3 ref: 00007FFD9390A7C6
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390A7D3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390A7EB
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD9390A809
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390A812
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390A82A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9390A90D
BIO_free.LIBCRYPTO-3 ref: 00007FFD9390A915

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFD9390A7E4, 00007FFD9390A823, 00007FFD9390A8B8, 00007FFD9390A8F5
SSL_use_PrivateKey_file, xrefs: 00007FFD9390A7D8, 00007FFD9390A817, 00007FFD9390A8AC, 00007FFD9390A8E9

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$O_ctrlO_freeO_newO_s_fileR_set_error
String ID: ..\s\ssl\ssl_rsa.c$SSL_use_PrivateKey_file
API String ID: 1899708915-420668618
Opcode ID: 3edad9cc728273c24525c025f0738f74cea89c26228cab9ff6bde505d92d58fe
Instruction ID: 836969cc71aa7a5739969b4c6b356efb246f4ca74a81053d260df8ee935a0655
Opcode Fuzzy Hash: 3edad9cc728273c24525c025f0738f74cea89c26228cab9ff6bde505d92d58fe
Instruction Fuzzy Hash: 11417429F09B42A1F670EBD1D4613FA6399EF84780F504036EE8D27796DE3CE5818B81

Function 00007FFD93942340 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,00007FFD93948A69), ref: 00007FFD93942366
ERR_set_debug.LIBCRYPTO-3(?,00007FFD93948A69), ref: 00007FFD9394237E
ERR_new.LIBCRYPTO-3(?,00007FFD93948A69), ref: 00007FFD939423BF
ERR_set_debug.LIBCRYPTO-3(?,00007FFD93948A69), ref: 00007FFD939423D7

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93942377, 00007FFD939423D0, 00007FFD93942426, 00007FFD9394249A, 00007FFD93942587, 00007FFD939425CB
set_client_ciphersuite, xrefs: 00007FFD9394236B, 00007FFD939423C4, 00007FFD9394241A, 00007FFD9394248E, 00007FFD9394257B, 00007FFD939425BF

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$set_client_ciphersuite
API String ID: 193678381-554836899
Opcode ID: e907b9082556d46cdec3aa4c743d4597454d6ee782b997f8dee89d8fe0c6d16f
Instruction ID: 868fdd102ce05bec199b8c32555ca600d0dc96eba4cfc260fb0d3a9010f9dde8
Opcode Fuzzy Hash: e907b9082556d46cdec3aa4c743d4597454d6ee782b997f8dee89d8fe0c6d16f
Instruction Fuzzy Hash: DA71A122B1864292EB74EBE5E8747A92398FF84B84F444031DE4E677D6DF2DE581CB40

Function 00007FFD938EB260 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD938EB29D
ERR_new.LIBCRYPTO-3 ref: 00007FFD938EB2A9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938EB2C1
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD938EB2ED
ERR_new.LIBCRYPTO-3 ref: 00007FFD938EB2FE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938EB316
BIO_free.LIBCRYPTO-3 ref: 00007FFD938EB410

Strings

ssl3_digest_cached_records, xrefs: 00007FFD938EB2AE, 00007FFD938EB303, 00007FFD938EB354, 00007FFD938EB3C6
..\s\ssl\s3_enc.c, xrefs: 00007FFD938EB2BA, 00007FFD938EB30F, 00007FFD938EB360, 00007FFD938EB3D2

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$O_ctrlO_freeX_new
String ID: ..\s\ssl\s3_enc.c$ssl3_digest_cached_records
API String ID: 1193811298-2469352020
Opcode ID: 2e46933e6f4de043fb6c14859512636f0fe02399f739e516c4fcfa2488e6e28b
Instruction ID: 9026a436df6a0a71e559abe5a6b2edf144d501b2f55c4c7ce117a60d39d13e0f
Opcode Fuzzy Hash: 2e46933e6f4de043fb6c14859512636f0fe02399f739e516c4fcfa2488e6e28b
Instruction Fuzzy Hash: 7841E736B1D64291F770EBE5E8617EA2398EF84784F440031EE0D67796DE3CD9908B40

Function 00007FFD938E1825 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

BIO_s_socket.LIBCRYPTO-3 ref: 00007FFD93903A8D
BIO_new.LIBCRYPTO-3 ref: 00007FFD93903A95
ERR_new.LIBCRYPTO-3 ref: 00007FFD93903AA2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93903ABA
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93903ACA
BIO_int_ctrl.LIBCRYPTO-3 ref: 00007FFD93903AEE
BIO_next.LIBCRYPTO-3 ref: 00007FFD93903B02
BIO_up_ref.LIBCRYPTO-3 ref: 00007FFD93903B15
BIO_next.LIBCRYPTO-3 ref: 00007FFD93903B29
BIO_next.LIBCRYPTO-3 ref: 00007FFD93903B42
BIO_free_all.LIBCRYPTO-3 ref: 00007FFD93903B56

Strings

SSL_set_fd, xrefs: 00007FFD93903AA7
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93903AB3

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_next$O_free_allO_int_ctrlO_newO_s_socketO_up_refR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_set_fd
API String ID: 2935861444-3152457077
Opcode ID: e22caefd459698eef22aae7eb673479cd39751a60846fff1320b17e4127f4f89
Instruction ID: 17b2ac2f7ace09a78e26792ccc9639bb303cdb2a5954cd7851428cea51ba1166
Opcode Fuzzy Hash: e22caefd459698eef22aae7eb673479cd39751a60846fff1320b17e4127f4f89
Instruction Fuzzy Hash: EB31612AB1A703A1EB74ABE5D5A13792358EF44BC8F441431ED0D37BDADE2CE4908B40

Function 00007FFD938E165E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93933FD3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93933FEB
ERR_new.LIBCRYPTO-3 ref: 00007FFD939341CE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939341E6
ERR_new.LIBCRYPTO-3 ref: 00007FFD93934201
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93934224
ERR_new.LIBCRYPTO-3 ref: 00007FFD93934253
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393426B

Strings

No groups enabled for max supported SSL/TLS version, xrefs: 00007FFD93934194, 00007FFD9393422C
tls_construct_ctos_supported_groups, xrefs: 00007FFD93933FD8, 00007FFD9393417C, 00007FFD939341D3, 00007FFD9393420B, 00007FFD93934258
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93933FE4, 00007FFD93934188, 00007FFD939341DF, 00007FFD93934217, 00007FFD93934264

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$No groups enabled for max supported SSL/TLS version$tls_construct_ctos_supported_groups
API String ID: 193678381-1756869798
Opcode ID: 64f1441907d4d7d4af363cf9d9b4f88ed42ace708fad04c62e9a6364c1dbe5e5
Instruction ID: bad776568fd8c65f09b19ea9bfbc836987515ce55b83f4bcfdb1ecfc2d18434e
Opcode Fuzzy Hash: 64f1441907d4d7d4af363cf9d9b4f88ed42ace708fad04c62e9a6364c1dbe5e5
Instruction Fuzzy Hash: ED718F61B1C642A2EB78ABD2E5207BB2398FB94780F504031ED4E67AD5DF7DE941CB00

Function 00007FFD938E1096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 180COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93945802
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394581A

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93945813, 00007FFD939459A9, 00007FFD93945A2E
tls_prepare_client_certificate, xrefs: 00007FFD93945807, 00007FFD9394599D, 00007FFD93945A22

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_prepare_client_certificate
API String ID: 193678381-816577172
Opcode ID: 0ac33749fb5b95e9910f669b4ed50a127f83b15fbbde37fca47158f81f1db84b
Instruction ID: 9325d7f9ff2391b55a48f14473991cd7e287ec17f6f7c13b62409a2d190d5637
Opcode Fuzzy Hash: 0ac33749fb5b95e9910f669b4ed50a127f83b15fbbde37fca47158f81f1db84b
Instruction Fuzzy Hash: 83718632B1865292EB749BD5E4643BD63A4EF84B84F541032DE4D6B7DADF3DD8818B00

Function 00007FFD93949560 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,00007FFD93946CCD), ref: 00007FFD93949604
ERR_set_debug.LIBCRYPTO-3(?,00007FFD93946CCD), ref: 00007FFD9394961C
ERR_new.LIBCRYPTO-3(?,00007FFD93946CCD), ref: 00007FFD939496A9
ERR_set_debug.LIBCRYPTO-3(?,00007FFD93946CCD), ref: 00007FFD939496C1
X509_get0_pubkey.LIBCRYPTO-3(?,00007FFD93946CCD), ref: 00007FFD939496FA
ERR_new.LIBCRYPTO-3(?,00007FFD93946CCD), ref: 00007FFD93949719
ERR_set_debug.LIBCRYPTO-3(?,00007FFD93946CCD), ref: 00007FFD93949731
ERR_new.LIBCRYPTO-3(?,00007FFD93946CCD), ref: 00007FFD93949746
ERR_set_debug.LIBCRYPTO-3(?,00007FFD93946CCD), ref: 00007FFD9394975E
ERR_new.LIBCRYPTO-3(?,00007FFD93946CCD), ref: 00007FFD93949775
ERR_set_debug.LIBCRYPTO-3(?,00007FFD93946CCD), ref: 00007FFD9394978D

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93949615, 00007FFD939496BA, 00007FFD9394972A, 00007FFD93949757, 00007FFD93949786
tls_process_ske_ecdhe, xrefs: 00007FFD93949609, 00007FFD939496AE, 00007FFD9394971E, 00007FFD9394974B, 00007FFD9394977A

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$X509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_ske_ecdhe
API String ID: 2988517565-1997102834
Opcode ID: 85bb5114a0b2ef34e6965820c3892ba924012811e787384668703692803aa349
Instruction ID: 5c5070da9e3b56d3a3ebc1dac45a0ef3a411c535d89d10fcec279869d1ceb0f1
Opcode Fuzzy Hash: 85bb5114a0b2ef34e6965820c3892ba924012811e787384668703692803aa349
Instruction Fuzzy Hash: 0951C276B18792A1E770EBA6E5247BA23A9FB84784F444032DE4D23786DF3CE150CB00

Function 00007FFD93908830 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD9390889C
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD939088B3
CT_POLICY_EVAL_CTX_new_ex.LIBCRYPTO-3 ref: 00007FFD939088F0
ERR_new.LIBCRYPTO-3 ref: 00007FFD939088FD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93908915
CT_POLICY_EVAL_CTX_free.LIBCRYPTO-3 ref: 00007FFD93908931
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93908947

Part of subcall function 00007FFD938E1CF3: SCT_LIST_free.LIBCRYPTO-3 ref: 00007FFD93900B43
Part of subcall function 00007FFD938E1CF3: d2i_OCSP_RESPONSE.LIBCRYPTO-3 ref: 00007FFD93900B95
Part of subcall function 00007FFD938E1CF3: OCSP_response_get1_basic.LIBCRYPTO-3 ref: 00007FFD93900BA5
Part of subcall function 00007FFD938E1CF3: OCSP_resp_count.LIBCRYPTO-3 ref: 00007FFD93900BB7
Part of subcall function 00007FFD938E1CF3: OCSP_resp_get0.LIBCRYPTO-3 ref: 00007FFD93900BC5
Part of subcall function 00007FFD938E1CF3: OCSP_SINGLERESP_get1_ext_d2i.LIBCRYPTO-3 ref: 00007FFD93900BDD
Part of subcall function 00007FFD938E1CF3: OCSP_resp_count.LIBCRYPTO-3 ref: 00007FFD93900C05
Part of subcall function 00007FFD938E1CF3: SCT_LIST_free.LIBCRYPTO-3 ref: 00007FFD93900C11
Part of subcall function 00007FFD938E1CF3: OCSP_BASICRESP_free.LIBCRYPTO-3 ref: 00007FFD93900C19
Part of subcall function 00007FFD938E1CF3: OCSP_RESPONSE_free.LIBCRYPTO-3 ref: 00007FFD93900C21

ERR_new.LIBCRYPTO-3 ref: 00007FFD939089B7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939089CF
ERR_new.LIBCRYPTO-3 ref: 00007FFD93908A02
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93908A1A

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD9390890E, 00007FFD939089C8, 00007FFD93908A13
ssl_validate_ct, xrefs: 00007FFD93908902, 00007FFD939089BC, 00007FFD93908A07

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$L_sk_numP_resp_countT_free$E_freeL_sk_valueP_freeP_get1_ext_d2iP_resp_get0P_response_get1_basicX_freeX_new_exd2i_
String ID: ..\s\ssl\ssl_lib.c$ssl_validate_ct
API String ID: 2834088071-2167807083
Opcode ID: 990dad7b21ffe31bad799d40a4e3447f5d5360bcbe68f08b7ee1f551ef8387f1
Instruction ID: 1662c1f7e14476637c791b1a76f69258e1bfd62c4c54bd4cdac6331c51913469
Opcode Fuzzy Hash: 990dad7b21ffe31bad799d40a4e3447f5d5360bcbe68f08b7ee1f551ef8387f1
Instruction Fuzzy Hash: CA518769F0E64265FA78ABE6D5713B91358EF45B80F540031DE4D67792DF3CE8818740

Function 00007FFD938E14E7 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939366A6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939366BE
ERR_new.LIBCRYPTO-3 ref: 00007FFD939366FA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93936712
ERR_new.LIBCRYPTO-3 ref: 00007FFD939367C4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939367DC

Strings

tls_parse_stoc_use_srtp, xrefs: 00007FFD939366AB, 00007FFD939366FF, 00007FFD93936772, 00007FFD939367C9
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD939366B7, 00007FFD9393670B, 00007FFD9393677E, 00007FFD939367D5

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_parse_stoc_use_srtp
API String ID: 193678381-2011129389
Opcode ID: 62b15b67a10bb955c91db070f5bd56eb6a6fa0a5d7f123e651474e24caf72fd1
Instruction ID: b84d0e3349a5b9df80c9fd4060a78e3a2ac00aab629391b8e33fc034418b097a
Opcode Fuzzy Hash: 62b15b67a10bb955c91db070f5bd56eb6a6fa0a5d7f123e651474e24caf72fd1
Instruction Fuzzy Hash: CD51F866B1CB8591E778EBD5E8A17F92798EB84B80F544431DA5E23BD2CE2CD490C700

Function 00007FFD93922790 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

BN_ucmp.LIBCRYPTO-3 ref: 00007FFD939227B0
BN_ucmp.LIBCRYPTO-3 ref: 00007FFD939227CB
BN_is_zero.LIBCRYPTO-3 ref: 00007FFD939227DF
BN_num_bits.LIBCRYPTO-3 ref: 00007FFD939227F3
ERR_new.LIBCRYPTO-3 ref: 00007FFD93922800
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93922818
ERR_new.LIBCRYPTO-3 ref: 00007FFD93922857
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9392286F
ERR_new.LIBCRYPTO-3 ref: 00007FFD939228C4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939228DC

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FFD93922811, 00007FFD93922868, 00007FFD939228D5
srp_verify_server_param, xrefs: 00007FFD9392280A, 00007FFD9392285C, 00007FFD939228C9

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$N_ucmp$N_is_zeroN_num_bits
String ID: ..\s\ssl\tls_srp.c$srp_verify_server_param
API String ID: 3341325393-16616462
Opcode ID: 18d925294a3572b34e2b9921010c0bbd4644a5ccf8161487fa3d987674c2a480
Instruction ID: 0b01c693f5f693abe70bdc60fef6f86e5da48daf88a331e1508e7dcaf680f836
Opcode Fuzzy Hash: 18d925294a3572b34e2b9921010c0bbd4644a5ccf8161487fa3d987674c2a480
Instruction Fuzzy Hash: D1312755F48A43A0FBB4ABE1D8717FA23589F84B84F484431DD0DAB7D6EE2CE5828710

Function 00007FFD938E2261 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 130COMMON

Download Yara Rule

APIs

EVP_MD_get0_name.LIBCRYPTO-3 ref: 00007FFD9392012F
OSSL_PARAM_construct_utf8_string.LIBCRYPTO-3 ref: 00007FFD93920176
OSSL_PARAM_construct_end.LIBCRYPTO-3 ref: 00007FFD939201AD
EVP_Q_mac.LIBCRYPTO-3 ref: 00007FFD939202E8
ERR_new.LIBCRYPTO-3 ref: 00007FFD939202F2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9392030A
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FFD93920331

Strings

properties, xrefs: 00007FFD93920167
..\s\ssl\tls13_enc.c, xrefs: 00007FFD93920303
tls13_final_finish_mac, xrefs: 00007FFD939202F7
finished, xrefs: 00007FFD93920232
HMAC, xrefs: 00007FFD939202DC

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: D_get0_nameL_cleanseM_construct_endM_construct_utf8_stringQ_macR_newR_set_debug
String ID: ..\s\ssl\tls13_enc.c$HMAC$finished$properties$tls13_final_finish_mac
API String ID: 3095186593-1708336846
Opcode ID: d870d57f4a8d1e1ec1caae4b2e99c27a5503b39d807635a0cf03397e713b640c
Instruction ID: cd66300bfb321033c1e18bc890da8fd33a053d6e6f57acd60e3445ce126cb289
Opcode Fuzzy Hash: d870d57f4a8d1e1ec1caae4b2e99c27a5503b39d807635a0cf03397e713b640c
Instruction Fuzzy Hash: F7515C22B08B8191E771DF95E4607EA63A4FB89784F444136EE8D27755EF3CD185CB40

Function 00007FFD93907830 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFD9390786D
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFD93907875
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD93907888
ERR_new.LIBCRYPTO-3 ref: 00007FFD93907895
EVP_MD_CTX_copy_ex.LIBCRYPTO-3 ref: 00007FFD939078A7
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FFD939078B9
ERR_new.LIBCRYPTO-3 ref: 00007FFD939078D8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939078F0
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD9390790D

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD939078E9
ssl_handshake_hash, xrefs: 00007FFD939078E2

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$D_get_sizeDigestFinal_exR_set_debugX_copy_exX_freeX_get0_mdX_new
String ID: ..\s\ssl\ssl_lib.c$ssl_handshake_hash
API String ID: 474506514-3232504857
Opcode ID: 0d8cc38b9c04fce3ccfed6e37c47c93c2ac3590197e10c60dae3ca6581a8d782
Instruction ID: f6fd0e82985b54c4ee7bfeb97d061e8496cac6cc7212ab6cbe558a10a20cbcb9
Opcode Fuzzy Hash: 0d8cc38b9c04fce3ccfed6e37c47c93c2ac3590197e10c60dae3ca6581a8d782
Instruction Fuzzy Hash: 5E217F29F08747A1F630AAD2ADA17BA5388BF40BD0F144031ED4E67796DE7CE4828740

Function 00007FFD9390C0F0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9390C10E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390C124
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9390C134
EVP_PKEY_new.LIBCRYPTO-3 ref: 00007FFD9390C14B
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390C158
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390C16E
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9390C17E

Strings

..\s\ssl\ssl_rsa_legacy.c, xrefs: 00007FFD9390C11D, 00007FFD9390C167
SSL_CTX_use_RSAPrivateKey, xrefs: 00007FFD9390C113, 00007FFD9390C15D

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$Y_new
String ID: ..\s\ssl\ssl_rsa_legacy.c$SSL_CTX_use_RSAPrivateKey
API String ID: 2166683265-3135413908
Opcode ID: bab9f2d17ed595648ca7d0107265f801c0e8bfdf9e56c739c15dc4f3a93d3b12
Instruction ID: 5abc9f5e74bb30531159c97bfc6ae88e4503109a8c9d19e2682ac29cc2543148
Opcode Fuzzy Hash: bab9f2d17ed595648ca7d0107265f801c0e8bfdf9e56c739c15dc4f3a93d3b12
Instruction Fuzzy Hash: 4621A229F2C64261EAA4F7E5E5613FA1399EF457C4F481030EE4E67E87DE2CE5918B00

Function 00007FFD9392E770 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9392E800
ERR_new.LIBCRYPTO-3 ref: 00007FFD9392E80F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9392E827
ERR_new.LIBCRYPTO-3 ref: 00007FFD9392E872
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9392E88A
ERR_new.LIBCRYPTO-3 ref: 00007FFD9392E9EA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9392EA02
ERR_new.LIBCRYPTO-3 ref: 00007FFD9392EA3E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9392EA56

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFD9392E820, 00007FFD9392E883, 00007FFD9392E9FB, 00007FFD9392EA4F
final_key_share, xrefs: 00007FFD9392E814, 00007FFD9392E877, 00007FFD9392E9F4, 00007FFD9392EA43

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ..\s\ssl\statem\extensions.c$final_key_share
API String ID: 476316267-2690623152
Opcode ID: e33aafe06eb222f047387b84a5275ec0d4ef69e9d598c9891cc0703c8d66f153
Instruction ID: 0afa22f7a745bb693492ebe83ab688fd15e910bbb9117508a77101d012d97cab
Opcode Fuzzy Hash: e33aafe06eb222f047387b84a5275ec0d4ef69e9d598c9891cc0703c8d66f153
Instruction Fuzzy Hash: AB71A526F08A82A1F7709AA5D8647BA3398FF80748F184035DE8D676D5DF7CD884CB51

Function 00007FFD939426D0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FFD93942710
ERR_new.LIBCRYPTO-3 ref: 00007FFD93942758
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93942770
ERR_new.LIBCRYPTO-3 ref: 00007FFD939427AA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939427C2

Part of subcall function 00007FFD938E1B2C: ERR_new.LIBCRYPTO-3 ref: 00007FFD93907163
Part of subcall function 00007FFD938E1B2C: ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390717B
Part of subcall function 00007FFD938E1B2C: ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9390718C

ERR_new.LIBCRYPTO-3 ref: 00007FFD9394284B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93942863

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93942769, 00007FFD939427BB, 00007FFD93942817, 00007FFD9394285C
ssl3_check_cert_and_algorithm, xrefs: 00007FFD9394275D, 00007FFD939427AF, 00007FFD9394280B, 00007FFD93942850

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$R_set_errorX509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$ssl3_check_cert_and_algorithm
API String ID: 1177010120-269904252
Opcode ID: ad44ac0159f1cc0c7c14a1e6138ea13d3176a924a9d2821877df9653f19f704c
Instruction ID: a554ada9de22b3d352ebcefe1de0625dc29662cc9b03806794a2b00b0a4d638c
Opcode Fuzzy Hash: ad44ac0159f1cc0c7c14a1e6138ea13d3176a924a9d2821877df9653f19f704c
Instruction Fuzzy Hash: D1419225F1864251E7B4A7E5E4653BA2368EF84B94F840032EE4E677D6DE2CE8818B00

Function 00007FFD938FA130 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3 ref: 00007FFD938FA18C
BIO_new.LIBCRYPTO-3 ref: 00007FFD938FA194
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD938FA1B4
ERR_set_mark.LIBCRYPTO-3 ref: 00007FFD938FA204
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD938FA232
OSSL_DECODER_CTX_free.LIBCRYPTO-3 ref: 00007FFD938FA23E
ERR_clear_last_mark.LIBCRYPTO-3 ref: 00007FFD938FA24A
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFD938FA251
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD938FA299
BIO_free.LIBCRYPTO-3 ref: 00007FFD938FA2A1

Strings

PEM, xrefs: 00007FFD938FA1D4

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_ctrl$O_freeO_newO_s_fileR_clear_last_markR_pop_to_markR_set_markX_freeY_free
String ID: PEM
API String ID: 753178889-379482575
Opcode ID: 8bced8c0135ef14e88c51e95f38f33fa2023c34d4e23a5081442ab6f33c06267
Instruction ID: e83d1133d5e0f994fce464376fc41e8ac5368dd72e82def8c52bde9e94452920
Opcode Fuzzy Hash: 8bced8c0135ef14e88c51e95f38f33fa2023c34d4e23a5081442ab6f33c06267
Instruction Fuzzy Hash: 27419625B0974351FA31ABE6A42027A6399FF84BD0F040131EE4D67B95DF3EE951CB41

Function 00007FFD938E17FD Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939480A9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939480C1
ERR_new.LIBCRYPTO-3 ref: 00007FFD939480F7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394810F

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD939480BA, 00007FFD93948108, 00007FFD93948182, 00007FFD939481BE
tls_process_initial_server_flight, xrefs: 00007FFD93948176, 00007FFD939481B2
tls_process_server_done, xrefs: 00007FFD939480AE, 00007FFD939480FC

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_initial_server_flight$tls_process_server_done
API String ID: 193678381-2920457334
Opcode ID: 6ef57c751edcf894c9b3c73731c64f3625680a3cf961eda0e4166f59258a41ac
Instruction ID: 3fd8cb328fbf95cfd23ae31169ddbfb7cbc6c83a5b15da0f6fe9201252aefa23
Opcode Fuzzy Hash: 6ef57c751edcf894c9b3c73731c64f3625680a3cf961eda0e4166f59258a41ac
Instruction Fuzzy Hash: 9F416D65F28342A1F774A7E1D8297FA2388AF85B84F440432D90E676D2DF2DE991C700

Function 00007FFD938E12B7 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

BIO_next.LIBCRYPTO-3 ref: 00007FFD93903E46
BIO_method_type.LIBCRYPTO-3 ref: 00007FFD93903E5C
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD93903E75
BIO_up_ref.LIBCRYPTO-3 ref: 00007FFD93903E81
BIO_new.LIBCRYPTO-3 ref: 00007FFD93903E90
ERR_new.LIBCRYPTO-3 ref: 00007FFD93903E9D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93903EB5
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93903EC5
BIO_free_all.LIBCRYPTO-3 ref: 00007FFD93903EF7

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD93903EAE
SSL_set_rfd, xrefs: 00007FFD93903EA2

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_ctrlO_free_allO_method_typeO_newO_nextO_up_refR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_set_rfd
API String ID: 1876162228-2433761532
Opcode ID: 19974ead120e90da7829f5932ac7322ddf741bf556c5e1ed9645990a77e4a5e2
Instruction ID: df8bf6f7f51b40b327c65bbe90c2c1547c2a99a29a1776d6680ceaa6da8c2f34
Opcode Fuzzy Hash: 19974ead120e90da7829f5932ac7322ddf741bf556c5e1ed9645990a77e4a5e2
Instruction Fuzzy Hash: 6F21B73AF1964262EB74E7D1E4A17BE2358AF84780F441531EE4E77792DE2CE4808B40

Function 00007FFD938E12DA Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

X509_new_ex.LIBCRYPTO-3 ref: 00007FFD939099F7
ERR_new.LIBCRYPTO-3 ref: 00007FFD93909A06
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93909A1E
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93909A2F
X509_free.LIBCRYPTO-3 ref: 00007FFD93909A5D
ERR_new.LIBCRYPTO-3 ref: 00007FFD93909A62
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93909A7A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93909A8B

Strings

SSL_CTX_use_certificate_ASN1, xrefs: 00007FFD93909A0B, 00007FFD93909A67
..\s\ssl\ssl_rsa.c, xrefs: 00007FFD93909A17, 00007FFD93909A73

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$X509_freeX509_new_ex
String ID: ..\s\ssl\ssl_rsa.c$SSL_CTX_use_certificate_ASN1
API String ID: 756758628-2599344068
Opcode ID: 4995d27b0bf1321174175f39b0be9676b82be707b6070146dbbec9efc161cf4d
Instruction ID: eb162c3a4e659af938e20bdb4a59cfdcbe2d530debba4d1b409f7951f668b5d5
Opcode Fuzzy Hash: 4995d27b0bf1321174175f39b0be9676b82be707b6070146dbbec9efc161cf4d
Instruction Fuzzy Hash: 2F216525B2D642A1E7A0E7E5E4617AE5354EF98780F941031FA4E637D6DE2CD4818B40

Function 00007FFD93915370 Relevance: 18.2, APIs: 12, Instructions: 177COMMON

Download Yara Rule

APIs

OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD939153A2
X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FFD939153EB
EVP_PKEY_get_security_bits.LIBCRYPTO-3 ref: 00007FFD939153F8
X509_get_extension_flags.LIBCRYPTO-3 ref: 00007FFD9391543D
X509_get_signature_info.LIBCRYPTO-3 ref: 00007FFD93915462

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_valueX509_get0_pubkeyX509_get_extension_flagsX509_get_signature_infoY_get_security_bits
String ID:
API String ID: 3095628011-0
Opcode ID: 6a90dacb690371e304f2445f9702f56de0f571147d6374ef0aa4f66c0045241f
Instruction ID: 85d21cec73e01b6f94d9fc5c1a74fac93e9bec4bc84e2af5497791ec4a008c29
Opcode Fuzzy Hash: 6a90dacb690371e304f2445f9702f56de0f571147d6374ef0aa4f66c0045241f
Instruction Fuzzy Hash: 6C51D826B1C28262FA74AAE664217BA538DBF88784F554135ED9E7BBC5DF3CD4018B00

Function 00007FFD938F9080 Relevance: 18.1, APIs: 12, Instructions: 87COMMON

Download Yara Rule

APIs

OPENSSL_sk_dup.LIBCRYPTO-3(?,?,00000000,00007FFD938F5694), ref: 00007FFD938F90AB
OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFD938F5694), ref: 00007FFD938F90C4
OPENSSL_sk_value.LIBCRYPTO-3(?,?,00000000,00007FFD938F5694), ref: 00007FFD938F90D5
OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFD938F5694), ref: 00007FFD938F90F0
OPENSSL_sk_num.LIBCRYPTO-3(?,?,00000000,00007FFD938F5694), ref: 00007FFD938F90FC
OPENSSL_sk_value.LIBCRYPTO-3(?,?,00000000,00007FFD938F5694), ref: 00007FFD938F9119
OPENSSL_sk_unshift.LIBCRYPTO-3(?,?,00000000,00007FFD938F5694), ref: 00007FFD938F913F
OPENSSL_sk_dup.LIBCRYPTO-3(?,?,00000000,00007FFD938F5694), ref: 00007FFD938F9151
OPENSSL_sk_free.LIBCRYPTO-3(?,?,00000000,00007FFD938F5694), ref: 00007FFD938F9161
OPENSSL_sk_free.LIBCRYPTO-3(?,?,00000000,00007FFD938F5694), ref: 00007FFD938F916D
OPENSSL_sk_set_cmp_func.LIBCRYPTO-3(?,?,00000000,00007FFD938F5694), ref: 00007FFD938F917F
OPENSSL_sk_free.LIBCRYPTO-3(?,?,00000000,00007FFD938F5694), ref: 00007FFD938F918F

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_freeL_sk_num$L_sk_dupL_sk_value$L_sk_set_cmp_funcL_sk_unshift
String ID:
API String ID: 621534355-0
Opcode ID: 178bee6722321e65cfedf7eb940de1229f7e8b50f333a6977fd5bd260898bda3
Instruction ID: 28086eaa5067080dc930ac0ea8f5ff427855721051051090358aabf6f925c10d
Opcode Fuzzy Hash: 178bee6722321e65cfedf7eb940de1229f7e8b50f333a6977fd5bd260898bda3
Instruction Fuzzy Hash: 3E31C325B0870295EA34EFE6A8752796769AFC9B80F044034EE4E57396DE3DE8918B00

Function 00007FFD9391D500 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,00007FFD9391AF9E), ref: 00007FFD9391D56A
BIO_printf.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,00007FFD9391AF9E), ref: 00007FFD9391D5AE
BIO_indent.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,00007FFD9391AF9E), ref: 00007FFD9391D605
BIO_printf.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,?,00007FFD9391AF9E), ref: 00007FFD9391D65E

Strings

message_seq=%d, fragment_offset=%d, fragment_length=%d, xrefs: 00007FFD9391D60F
%s, Length=%d, xrefs: 00007FFD9391D5A4
Unsupported, hex dump follows:, xrefs: 00007FFD9391D9CF
UNKNOWN, xrefs: 00007FFD9391D580

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s, Length=%d$UNKNOWN$Unsupported, hex dump follows:$message_seq=%d, fragment_offset=%d, fragment_length=%d
API String ID: 1860387303-4198474627
Opcode ID: 91d8314591db20df800a7da1d8fd2c5e320f8efe3173f04a01c1687770077c5c
Instruction ID: 230692b4d1cf838d7806bae704198524d613ab63f58d49ea5b943a9b32392746
Opcode Fuzzy Hash: 91d8314591db20df800a7da1d8fd2c5e320f8efe3173f04a01c1687770077c5c
Instruction Fuzzy Hash: 8E5124627082E156E734DB99A824B7E3B99EB857D4F008131EEAD63BD5CE3CD541CB00

Function 00007FFD9391C7F0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 111COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3(?,?,?,?,?,00007FFD9391D420,?,?,?,?,?,?,00007FFD9391B5F8), ref: 00007FFD9391C826
BIO_printf.LIBCRYPTO-3(?,?,?,?,?,00007FFD9391D420,?,?,?,?,?,?,00007FFD9391B5F8), ref: 00007FFD9391C87A

Strings

server_verify_data, xrefs: 00007FFD9391CFBE
UNKNOWN, xrefs: 00007FFD9391C840
extension_type=%s(%d), length=%d, xrefs: 00007FFD9391C869
<EMPTY>, xrefs: 00007FFD9391D002
client_verify_data, xrefs: 00007FFD9391CF9A, 00007FFD9391CFDF

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_indentO_printf
String ID: <EMPTY>$UNKNOWN$client_verify_data$extension_type=%s(%d), length=%d$server_verify_data
API String ID: 1860387303-127224826
Opcode ID: 5862d4356951e052ad7eaed82b16746939e3355140c451577a94c6f812020e4a
Instruction ID: 718b2ae8caeef0b61f123ec9001fe82b9ece6545db7a288e54706ae3bc97644a
Opcode Fuzzy Hash: 5862d4356951e052ad7eaed82b16746939e3355140c451577a94c6f812020e4a
Instruction Fuzzy Hash: F941B236B0C692A9E6348BC5E4607BA6769FB89B80F444031DE4E33B95DF3CE542CB40

Function 00007FFD938E2315 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93951187
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395119F
ERR_new.LIBCRYPTO-3 ref: 00007FFD939511C4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939511DC
ERR_new.LIBCRYPTO-3 ref: 00007FFD93951205
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395121D
ERR_new.LIBCRYPTO-3 ref: 00007FFD93951253
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395126B

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD93951198, 00007FFD939511D5, 00007FFD93951216, 00007FFD93951264
tls_process_change_cipher_spec, xrefs: 00007FFD9395118C, 00007FFD939511C9, 00007FFD9395120A, 00007FFD93951258

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_process_change_cipher_spec
API String ID: 193678381-3810074443
Opcode ID: 522da9b3beb261c0b84c81c1e5b9289c1f6ee77c1ef101be81f09331d13848a9
Instruction ID: 3902a1d74b6bcd3848a7b1c6bb2ec80c02262ca2d9f90f42b8ea000adf10b155
Opcode Fuzzy Hash: 522da9b3beb261c0b84c81c1e5b9289c1f6ee77c1ef101be81f09331d13848a9
Instruction Fuzzy Hash: C0418C66F08282A2FBB4EBE1D8657F92398AF84748F444432DD0D636D2DF6CA9C5C700

Function 00007FFD9391D2E0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9391B5F8), ref: 00007FFD9391D327
BIO_puts.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9391B5F8), ref: 00007FFD9391D33B
BIO_puts.LIBCRYPTO-3(?,?,?,?,?,?,00007FFD9391B5F8), ref: 00007FFD9391D38B

Strings

No extensions, xrefs: 00007FFD9391D331, 00007FFD9391D381
extensions, extype = %d, extlen = %d, xrefs: 00007FFD9391D450
extensions, length = %d, xrefs: 00007FFD9391D3AC

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_puts$O_indent
String ID: No extensions$extensions, extype = %d, extlen = %d$extensions, length = %d
API String ID: 3358443131-3081145182
Opcode ID: c762ab333882584ce8f0169b4dba7062ddae6f5a73a86c39bcdf488755cf4005
Instruction ID: f8d8af9eb98fb82deaaa22352395dccc0bcba696cff4e521201e224db6063129
Opcode Fuzzy Hash: c762ab333882584ce8f0169b4dba7062ddae6f5a73a86c39bcdf488755cf4005
Instruction Fuzzy Hash: AB4128637082D159D730CB95A820779B7A9FB89B94F488131EE8C23B89DF3CE545C700

Function 00007FFD938E1375 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-3 ref: 00007FFD93911143
BIO_printf.LIBCRYPTO-3 ref: 00007FFD93911173
BIO_puts.LIBCRYPTO-3 ref: 00007FFD93911192
BIO_printf.LIBCRYPTO-3 ref: 00007FFD939111C0
BIO_puts.LIBCRYPTO-3 ref: 00007FFD939111DC

Strings

%02X, xrefs: 00007FFD93911169, 00007FFD939111B6
RSA , xrefs: 00007FFD93911125
Master-Key:, xrefs: 00007FFD93911188
Session-ID:, xrefs: 00007FFD93911139

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_puts$O_printf
String ID: Master-Key:$%02X$RSA $Session-ID:
API String ID: 4098839300-1878088908
Opcode ID: fda8fcf2d81b2b0c740b8bfcb5be14cfd8bb3c30529b8a77aa9d5ac2da1480ae
Instruction ID: 8e5db21e70a39df4168981f93a4b77883369061697475f56e80e1f9b4d9cee68
Opcode Fuzzy Hash: fda8fcf2d81b2b0c740b8bfcb5be14cfd8bb3c30529b8a77aa9d5ac2da1480ae
Instruction Fuzzy Hash: D331B321B0DA82B1E6A597D5DA743B9A368FF48B88F448031EE0E73695DF2CE651C704

Function 00007FFD939072F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD9390732B
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD9390733F

Part of subcall function 00007FFD93905A60: OPENSSL_sk_pop_free.LIBCRYPTO-3(00000000,00007FFD938FFE08), ref: 00007FFD93905A81
Part of subcall function 00007FFD93905A60: OPENSSL_sk_pop_free.LIBCRYPTO-3(00000000,00007FFD938FFE08), ref: 00007FFD93905A97
Part of subcall function 00007FFD93905A60: X509_free.LIBCRYPTO-3(00000000,00007FFD938FFE08), ref: 00007FFD93905AA4

OPENSSL_sk_new_reserve.LIBCRYPTO-3 ref: 00007FFD93907376
ERR_new.LIBCRYPTO-3 ref: 00007FFD93907387
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390739F
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD939073B0
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD939073C9

Strings

ssl_dane_dup, xrefs: 00007FFD9390738C
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93907398

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_numL_sk_pop_free$L_sk_new_reserveL_sk_valueR_newR_set_debugR_set_errorX509_free
String ID: ..\s\ssl\ssl_lib.c$ssl_dane_dup
API String ID: 641917998-780499551
Opcode ID: c2c7d87bce939961a0199c6e8bee7f3c77e2c972a0f7738d754dfb736ed6e270
Instruction ID: dcf865fe8faed5eb26456b35aab12de699c80f67c085ce67f5d38de0a6adead5
Opcode Fuzzy Hash: c2c7d87bce939961a0199c6e8bee7f3c77e2c972a0f7738d754dfb736ed6e270
Instruction Fuzzy Hash: B831A12A70878292E764DBA5E4603AE6769FB84B80F444435EE8D63796DE3CD5408710

Function 00007FFD93905670 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3(?,00007FFD93900C79), ref: 00007FFD939056A5
ERR_new.LIBCRYPTO-3(?,00007FFD93900C79), ref: 00007FFD939056B2
ERR_set_debug.LIBCRYPTO-3(?,00007FFD93900C79), ref: 00007FFD939056CA
ERR_set_error.LIBCRYPTO-3(?,00007FFD93900C79), ref: 00007FFD939056DA
SCT_free.LIBCRYPTO-3(?,00007FFD93900C79), ref: 00007FFD939056E2
OPENSSL_sk_push.LIBCRYPTO-3(?,00007FFD93900C79), ref: 00007FFD93905715
OPENSSL_sk_pop.LIBCRYPTO-3(?,00007FFD93900C79), ref: 00007FFD93905723

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD939056C3
ct_move_scts, xrefs: 00007FFD939056B7

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_new_nullL_sk_popL_sk_pushR_newR_set_debugR_set_errorT_free
String ID: ..\s\ssl\ssl_lib.c$ct_move_scts
API String ID: 678090195-2572802885
Opcode ID: e8f2d14d73432a17dfe26c064f1f3f55e634b60d6841f4f352f828a2021878d4
Instruction ID: d5714e7350563c714f62cd4d1b01992e7819b39dd6e2892b81655c3d20aaa1ef
Opcode Fuzzy Hash: e8f2d14d73432a17dfe26c064f1f3f55e634b60d6841f4f352f828a2021878d4
Instruction Fuzzy Hash: 75217829B1D742A1FA30FFD69420679639DAF94780F544431EE4D67BD6DE3CE4918B00

Function 00007FFD938E1294 Relevance: 15.3, APIs: 10, Instructions: 289COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FFD9394A216
EVP_CIPHER_get_flags.LIBCRYPTO-3 ref: 00007FFD9394A21E
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFD9394A230
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFD9394A238
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FFD9394A251
EVP_CIPHER_get_mode.LIBCRYPTO-3 ref: 00007FFD9394A259
EVP_CIPHER_CTX_get_block_size.LIBCRYPTO-3 ref: 00007FFD9394A26A
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD9394A2EA
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD9394A325
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD9394A46E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_ctrl$X_get0_cipher$D_get_sizeR_get_flagsR_get_modeX_get0_mdX_get_block_size
String ID:
API String ID: 3427282322-0
Opcode ID: 9ba387fe39d584fff998017688e6a5302e9891b1d7b35a3b47eecf7aa9efcc48
Instruction ID: d97e4e239b654372e14c2c04011ad815dc5bfef25252dae7c53fa7ff1e537fac
Opcode Fuzzy Hash: 9ba387fe39d584fff998017688e6a5302e9891b1d7b35a3b47eecf7aa9efcc48
Instruction Fuzzy Hash: EFD1D363B097E185E7709FA584A43FC37A8EB45B88F088136DE8D5739ADE38D590C711

Function 00007FFD938E12A8 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

BIO_new.LIBCRYPTO-3 ref: 00007FFD938E5FCF
BIO_new.LIBCRYPTO-3 ref: 00007FFD938E5FFF
BIO_free.LIBCRYPTO-3 ref: 00007FFD938E609A
BIO_free.LIBCRYPTO-3 ref: 00007FFD938E60A2

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_freeO_new
String ID:
API String ID: 4227620691-0
Opcode ID: 9af4bb0d0e66f5df0d633afe5796e4b84df038deb506c1da50831db546e3dd56
Instruction ID: cef8943a697681f118f50f6a195790316e941cfc78204d39e15f694f2ba67192
Opcode Fuzzy Hash: 9af4bb0d0e66f5df0d633afe5796e4b84df038deb506c1da50831db546e3dd56
Instruction Fuzzy Hash: BD217C44B1E75294FA78B7E2597127A13986F85BC4F440034EE0E77B86EE2EE4414B00

Function 00007FFD938E20B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FFD9391FC5B
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FFD9391FC90
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FFD9391FCB6
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FFD9391FCD3
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FFD9391FCE9
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FFD9391FD03
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD9391FDB7

Strings

exporter, xrefs: 00007FFD9391FD67

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: Digest$Final_exInit_ex$UpdateX_freeX_new
String ID: exporter
API String ID: 3991325671-111224270
Opcode ID: 8658a91171fae5a8d5ed054dd2db533ec410306234abf4b43626a48e8451353a
Instruction ID: 1c21c36b45728708b4e419d4b5ab433fcf1ea464712229b932d1d21c380aae47
Opcode Fuzzy Hash: 8658a91171fae5a8d5ed054dd2db533ec410306234abf4b43626a48e8451353a
Instruction Fuzzy Hash: 8241623670878655EA35DF96E8607EAA3A8EF8A7C0F440132ED8D67B55DF3CE0418B00

Function 00007FFD938E21E9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9394FE84
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394FE9C
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394FF16
memcpy.VCRUNTIME140 ref: 00007FFD9394FF43
memcpy.VCRUNTIME140 ref: 00007FFD9394FF60

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD9394FE95
CLIENT_RANDOM, xrefs: 00007FFD9394FEF5
tls_construct_finished, xrefs: 00007FFD9394FE89, 00007FFD9394FF1B

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newmemcpy$R_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$CLIENT_RANDOM$tls_construct_finished
API String ID: 3909032045-3711601257
Opcode ID: 60426255eba6112f76f80d07a8eade3406939433570aeb2bfc7c873cad3bf0fd
Instruction ID: 8acfa297bd5dc4a89591678f2c106d541b3e830a813e1c4f2bae6de326f78381
Opcode Fuzzy Hash: 60426255eba6112f76f80d07a8eade3406939433570aeb2bfc7c873cad3bf0fd
Instruction Fuzzy Hash: 0C517336B0875392E770DFA5D4687E923A8EB45B88F041036DE4E67796EF39D981C300

Function 00007FFD938E223E Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93944738
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93944750
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394478D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939447A5
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394483D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93944855

Strings

tls_construct_client_certificate, xrefs: 00007FFD9394473D, 00007FFD93944792, 00007FFD93944842
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93944749, 00007FFD9394479E, 00007FFD9394484E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_construct_client_certificate
API String ID: 193678381-1244782752
Opcode ID: 47e3d7a25f3da6ff5af681691d33c7ba41185fd2372be43874d5b8a1d311f6c2
Instruction ID: f4dc72573758ce5910419052893349b1c55e55df84a6e38f2d645aad2e598ae9
Opcode Fuzzy Hash: 47e3d7a25f3da6ff5af681691d33c7ba41185fd2372be43874d5b8a1d311f6c2
Instruction Fuzzy Hash: B6418165B1828292E7B4EBE5E978BFA2398EF45B84F444032DD4D676D6DF2CE4818700

Function 00007FFD938E10EB Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93935A22
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93935A3A
ERR_new.LIBCRYPTO-3 ref: 00007FFD93935B5F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93935B77

Strings

tls_parse_stoc_psk, xrefs: 00007FFD93935A27, 00007FFD93935A9B, 00007FFD93935B64
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93935A33, 00007FFD93935AA7, 00007FFD93935B70

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_parse_stoc_psk
API String ID: 193678381-1931443905
Opcode ID: 4e5b55db31039d31d9750c5e52b3d1bdf07f441a2022e32ca7753edf101a8f01
Instruction ID: 5f5b5b2026a129792730e925bc3507bdbbc8af3223df1da4aff4573dea4697e0
Opcode Fuzzy Hash: 4e5b55db31039d31d9750c5e52b3d1bdf07f441a2022e32ca7753edf101a8f01
Instruction Fuzzy Hash: 8C419462F08A8695F764DFA4D4613FA33A8EB98B48F584131DE4D5B296DF3CE5C18B00

Function 00007FFD938E127B Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FFD93928460
BIO_write.LIBCRYPTO-3 ref: 00007FFD93928485
ERR_new.LIBCRYPTO-3 ref: 00007FFD93928506
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9392851E
ERR_new.LIBCRYPTO-3 ref: 00007FFD93928562
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9392857A

Strings

ssl3_write_pending, xrefs: 00007FFD9392850B, 00007FFD93928567
..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FFD93928517, 00007FFD93928573

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$ErrorLastO_write
String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_write_pending
API String ID: 433171503-1219543453
Opcode ID: bf9cdb09f0e300db7620d2724ffb2bedf2de1bc094931e3f46119badfe91375f
Instruction ID: 07430c0b1b3e6d9cc23456d67f06272c49e2dff18b110abcb04402ed919b3571
Opcode Fuzzy Hash: bf9cdb09f0e300db7620d2724ffb2bedf2de1bc094931e3f46119badfe91375f
Instruction Fuzzy Hash: 1041AE32B0DB42A6EB74DBA9D4647A933A8FB44B84F544136DA0D23B95DF3DE851C300

Function 00007FFD9394D450 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FFD9394F905), ref: 00007FFD9394D55B
BIO_ctrl.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9394F905), ref: 00007FFD9394D581
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9394F905), ref: 00007FFD9394D58A
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,00007FFD9394F905), ref: 00007FFD9394D5A2

Strings

get_cert_verify_tbs_data, xrefs: 00007FFD9394D58F
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD9394D59B
TLS 1.3, client CertificateVerify, xrefs: 00007FFD9394D4C9
TLS 1.3, server CertificateVerify, xrefs: 00007FFD9394D4F1

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_ctrlR_newR_set_debugmemcpy
String ID: ..\s\ssl\statem\statem_lib.c$TLS 1.3, client CertificateVerify$TLS 1.3, server CertificateVerify$get_cert_verify_tbs_data
API String ID: 152836652-3760622993
Opcode ID: 05f68823373f23e9663de47f1c69a2da06f222f5d74598419237d48ab8bc82a0
Instruction ID: deef9eda52deb6ed3b6be2ce299c153d0a170946792369bc9cff6580f0593d62
Opcode Fuzzy Hash: 05f68823373f23e9663de47f1c69a2da06f222f5d74598419237d48ab8bc82a0
Instruction Fuzzy Hash: 9241F566B08792A6E770CF94D4643BC77A4FB95B88F408132DA8DA3696DF3CE590C700

Function 00007FFD938E26F3 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93934386
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393439E

Strings

tls_construct_ctos_supported_versions, xrefs: 00007FFD9393438B, 00007FFD9393447F
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93934397, 00007FFD93934486

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_supported_versions
API String ID: 193678381-3987601604
Opcode ID: 7d9f7386757de1acade9f54d333396f3bafaae9891502917c6c8fb9a60050746
Instruction ID: 64936adba52460ff1000081e63ee00d2bd3af01307459ae1e93e3ee6936a651a
Opcode Fuzzy Hash: 7d9f7386757de1acade9f54d333396f3bafaae9891502917c6c8fb9a60050746
Instruction Fuzzy Hash: A931A0A1B0C24261FB74A7D1E6653BB5399AF807C4F550031EE4D6BADADF2DE9428B00

Function 00007FFD939083E0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939084A0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939084B8
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93908517

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD939084B1, 00007FFD939084FF
(, xrefs: 00007FFD9390845D
ssl_start_async_job, xrefs: 00007FFD939084A5, 00007FFD939084F3

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ($..\s\ssl\ssl_lib.c$ssl_start_async_job
API String ID: 1552677711-1319532896
Opcode ID: 4531f297435977068fc41978c83a305b3a19b3c147982f5094811f45cda28054
Instruction ID: d82473cc29caafb1a3542b1beb5f5a59e863370918b04651210174f60a4f24fc
Opcode Fuzzy Hash: 4531f297435977068fc41978c83a305b3a19b3c147982f5094811f45cda28054
Instruction Fuzzy Hash: 56315E7AB0D642A1E7309FE4E4643EA7368EB44798F640131EA4C676D6DF7CD984CB40

Function 00007FFD938E2207 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9395BDD9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395BDF1
ERR_new.LIBCRYPTO-3 ref: 00007FFD9395BE1F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395BE37

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD9395BDEA, 00007FFD9395BE30, 00007FFD9395BE7A
tls_process_end_of_early_data, xrefs: 00007FFD9395BDDE, 00007FFD9395BE24, 00007FFD9395BE6E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_end_of_early_data
API String ID: 193678381-3379596787
Opcode ID: 5b1ef5d411f48c5a7d8d6e1d3c280f35ddc56ed48339d34cdb799238054dfff6
Instruction ID: a2bbe5b50c44d9119805ce7215265b0fd22cfaaad472d132ab25c97a5c245f7c
Opcode Fuzzy Hash: 5b1ef5d411f48c5a7d8d6e1d3c280f35ddc56ed48339d34cdb799238054dfff6
Instruction Fuzzy Hash: 55219F65F18242A6F774EBF0D8267F92388AF80740F584031C90EA76C2DF6DA9C5CB40

Function 00007FFD938E1686 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93951819
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93951831
ERR_new.LIBCRYPTO-3 ref: 00007FFD93951870
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93951888

Strings

tls_process_key_update, xrefs: 00007FFD9395181E, 00007FFD93951875, 00007FFD939518BA
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD9395182A, 00007FFD93951881, 00007FFD939518C6

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_process_key_update
API String ID: 193678381-597347991
Opcode ID: 29c723160eaeccd918e91a572f20d26d1d019dcd008e3f0eb2bd94873a2d9714
Instruction ID: 2b2903cc184175136fc13d72ac3a7ac64d401ff98a9a719c0ea1a6a93fe9b1fb
Opcode Fuzzy Hash: 29c723160eaeccd918e91a572f20d26d1d019dcd008e3f0eb2bd94873a2d9714
Instruction Fuzzy Hash: 4421AB65F0874371FB74ABE2E9607BA2359AF84384F544032DE0E236D2DF2DE9908B40

Function 00007FFD938E177B Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93936299
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939362B1
ERR_new.LIBCRYPTO-3 ref: 00007FFD939362E3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939362FB
ERR_new.LIBCRYPTO-3 ref: 00007FFD93936327
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393633F

Strings

tls_parse_stoc_session_ticket, xrefs: 00007FFD9393629E, 00007FFD939362E8, 00007FFD9393632C
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD939362AA, 00007FFD939362F4, 00007FFD93936338

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_parse_stoc_session_ticket
API String ID: 193678381-795302288
Opcode ID: 7569506422c07eb92df6d3688399514f61789aef830400ca2956908e2d640d88
Instruction ID: 5ed46933611294e0a318eb9d2b5ac62b44a1e39082cf4e7e2be69d7d78cab503
Opcode Fuzzy Hash: 7569506422c07eb92df6d3688399514f61789aef830400ca2956908e2d640d88
Instruction Fuzzy Hash: 3621E261F0CA4261F778A7E5E8653EA1398EF84780F944031ED0E67BD6DE2CE4808700

Function 00007FFD938E1627 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93903800
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93903815
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD9390382E

Strings

SSL_set_cipher_list, xrefs: 00007FFD93903855
..\s\ssl\ssl_lib.c, xrefs: 00007FFD93903861

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_num$L_sk_value
String ID: ..\s\ssl\ssl_lib.c$SSL_set_cipher_list
API String ID: 1603723057-1252523853
Opcode ID: 0cdc888642a4c7ec4b4db4ee68f31cf0bed92deb90d71d28f91530e20ff43650
Instruction ID: aa507b1788bc5483d328c2023cb9cb0ad6e9b7ac81ee753b7a84356e9a277470
Opcode Fuzzy Hash: 0cdc888642a4c7ec4b4db4ee68f31cf0bed92deb90d71d28f91530e20ff43650
Instruction Fuzzy Hash: 3421C826B1974192E760AB99E4A03FA63A8FF84784F540035DF4C67792DF3DD5428B00

Function 00007FFD938E1384 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD938FDDD0
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD938FDDE5
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD938FDDFE

Strings

SSL_CTX_set_cipher_list, xrefs: 00007FFD938FDE25
..\s\ssl\ssl_lib.c, xrefs: 00007FFD938FDE31

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_num$L_sk_value
String ID: ..\s\ssl\ssl_lib.c$SSL_CTX_set_cipher_list
API String ID: 1603723057-1814062246
Opcode ID: 3d304f5563a97701548db3dfe9b26dbf5cd5e5ff3eb041c5f35f6c751ca3617e
Instruction ID: 0acf7a7183fb2f71b49402fb8c2f1862c18337942eeddab270c6aa465d95c1f3
Opcode Fuzzy Hash: 3d304f5563a97701548db3dfe9b26dbf5cd5e5ff3eb041c5f35f6c751ca3617e
Instruction Fuzzy Hash: D421C926B1875193E760ABA9E4603F963A8EF94788F540031EF4C537E6DF3DD9468B40

Function 00007FFD938E17A3 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

BIO_new.LIBCRYPTO-3 ref: 00007FFD938EC23E
ERR_new.LIBCRYPTO-3 ref: 00007FFD938EC24B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938EC263
BIO_free.LIBCRYPTO-3 ref: 00007FFD938EC290
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FFD938EC2A7
BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD938EC2CC

Strings

ssl3_init_finished_mac, xrefs: 00007FFD938EC250
..\s\ssl\s3_enc.c, xrefs: 00007FFD938EC25C

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_ctrlO_freeO_newR_newR_set_debugX_free
String ID: ..\s\ssl\s3_enc.c$ssl3_init_finished_mac
API String ID: 1341981153-3994752933
Opcode ID: a55c4d5e2d92631bf5f834d8452a45869b6b17d71c184bb8b097b1ae6fe7c17b
Instruction ID: f32fa52b942135b23e8a77402abe1862630ff2829a065620b136c5a0dd6ffdc0
Opcode Fuzzy Hash: a55c4d5e2d92631bf5f834d8452a45869b6b17d71c184bb8b097b1ae6fe7c17b
Instruction Fuzzy Hash: 4B118236B0874261E7B4FBE1F5617E92354EB84784F444030DE0D1BB96DE3CE5808700

Function 00007FFD939051A0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93902D97), ref: 00007FFD939051CE
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93902D97), ref: 00007FFD939051E6
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93902D97), ref: 00007FFD939051F7
ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93902D97), ref: 00007FFD93905210
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93902D97), ref: 00007FFD93905228
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,?,?,?,?,?,00007FFD93902D97), ref: 00007FFD93905239

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD939051DF, 00007FFD93905221
can_renegotiate, xrefs: 00007FFD939051D3, 00007FFD93905215

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$can_renegotiate
API String ID: 1552677711-3796731956
Opcode ID: ffee28e96335aa704968abb80b6c1ed724ff21ba08e802f7bdb6329489e06ba8
Instruction ID: 13e021ad27ff713763fb6c7fc4f1408f4179430faeced6df3751bb96e5ad66dc
Opcode Fuzzy Hash: ffee28e96335aa704968abb80b6c1ed724ff21ba08e802f7bdb6329489e06ba8
Instruction Fuzzy Hash: 5C118469F2924663F7A4EBE8C8627EA2394FF50700FD04031E54CA36D2CE2CE985CA01

Function 00007FFD938E2333 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD938FC04D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FC065
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FC076
ERR_new.LIBCRYPTO-3 ref: 00007FFD938FC08E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FC0A6
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FC0B7

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD938FC05E, 00007FFD938FC09F
SSL_CTX_check_private_key, xrefs: 00007FFD938FC052, 00007FFD938FC093

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_CTX_check_private_key
API String ID: 1552677711-2096838628
Opcode ID: 47520c5f97b16008fda1cc4b12aafc570e90f933446927589590d1bf795c4cd6
Instruction ID: 4b2e645b257471d48e92a61e61e04688032840f1669dad66cbbd4c03c6d00653
Opcode Fuzzy Hash: 47520c5f97b16008fda1cc4b12aafc570e90f933446927589590d1bf795c4cd6
Instruction Fuzzy Hash: 5D01C46CF1A70662FBB4E7E4C8713BA23A8AF80340FA04031D90D227D1EE2DE5868741

Function 00007FFD938F26B0 Relevance: 13.6, APIs: 9, Instructions: 99COMMON

Download Yara Rule

APIs

X509_get_subject_name.LIBCRYPTO-3(?,?,00000001,00007FFD938F1FDE), ref: 00007FFD938F277C
X509_NAME_dup.LIBCRYPTO-3(?,?,00000001,00007FFD938F1FDE), ref: 00007FFD938F2789
X509_NAME_free.LIBCRYPTO-3(?,?,00000001,00007FFD938F1FDE), ref: 00007FFD938F27A8
OPENSSL_sk_push.LIBCRYPTO-3(?,?,00000001,00007FFD938F1FDE), ref: 00007FFD938F27B5
OSSL_STORE_INFO_free.LIBCRYPTO-3(?,?,00000001,00007FFD938F1FDE), ref: 00007FFD938F27C1
OSSL_STORE_eof.LIBCRYPTO-3(?,?,00000001,00007FFD938F1FDE), ref: 00007FFD938F27C9
ERR_clear_error.LIBCRYPTO-3(?,?,00000001,00007FFD938F1FDE), ref: 00007FFD938F27D6
X509_NAME_free.LIBCRYPTO-3(?,?,00000001,00007FFD938F1FDE), ref: 00007FFD938F27E0
OSSL_STORE_close.LIBCRYPTO-3(?,?,00000001,00007FFD938F1FDE), ref: 00007FFD938F27EB

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: X509_$E_free$E_closeE_dupE_eofL_sk_pushO_freeR_clear_errorX509_get_subject_name
String ID:
API String ID: 1726013196-0
Opcode ID: 6f23f7b54a11d709552117ddb9c7223c8944742f81841d3e0c78c538a5bb88f6
Instruction ID: 8ca6e1ac0fc833e68b56f42f3834089b21ef9954a84b256d1441f6ce5fff1157
Opcode Fuzzy Hash: 6f23f7b54a11d709552117ddb9c7223c8944742f81841d3e0c78c538a5bb88f6
Instruction Fuzzy Hash: 4D31381CF0D74315FD75BBE6693137A12A85F85BC0F840034ED0E6AB96EE2DF8824A90

Function 00007FFD939053F0 Relevance: 13.6, APIs: 9, Instructions: 75COMMON

Download Yara Rule

APIs

d2i_OCSP_RESPONSE.LIBCRYPTO-3 ref: 00007FFD93905444
OCSP_response_get1_basic.LIBCRYPTO-3 ref: 00007FFD93905454
OCSP_resp_count.LIBCRYPTO-3 ref: 00007FFD9390546B
OCSP_resp_get0.LIBCRYPTO-3 ref: 00007FFD93905479
OCSP_SINGLERESP_get1_ext_d2i.LIBCRYPTO-3 ref: 00007FFD93905491

Part of subcall function 00007FFD93905670: OPENSSL_sk_new_null.LIBCRYPTO-3(?,00007FFD93900C79), ref: 00007FFD939056A5
Part of subcall function 00007FFD93905670: ERR_new.LIBCRYPTO-3(?,00007FFD93900C79), ref: 00007FFD939056B2
Part of subcall function 00007FFD93905670: ERR_set_debug.LIBCRYPTO-3(?,00007FFD93900C79), ref: 00007FFD939056CA
Part of subcall function 00007FFD93905670: ERR_set_error.LIBCRYPTO-3(?,00007FFD93900C79), ref: 00007FFD939056DA
Part of subcall function 00007FFD93905670: SCT_free.LIBCRYPTO-3(?,00007FFD93900C79), ref: 00007FFD939056E2

OCSP_resp_count.LIBCRYPTO-3 ref: 00007FFD939054B9
SCT_LIST_free.LIBCRYPTO-3 ref: 00007FFD939054CA
OCSP_BASICRESP_free.LIBCRYPTO-3 ref: 00007FFD939054D2
OCSP_RESPONSE_free.LIBCRYPTO-3 ref: 00007FFD939054DA

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: P_resp_countT_free$E_freeL_sk_new_nullP_freeP_get1_ext_d2iP_resp_get0P_response_get1_basicR_newR_set_debugR_set_errord2i_
String ID:
API String ID: 2730705051-0
Opcode ID: 0e7fa4a51d6b1f64f47392326b463c9cfd1bb6ecd7d7e87c3f01f1a2ef2afe8b
Instruction ID: b94b0d500c97a5d41e2b996b39b305f57bfee68f308372e6b88250bb392875e6
Opcode Fuzzy Hash: 0e7fa4a51d6b1f64f47392326b463c9cfd1bb6ecd7d7e87c3f01f1a2ef2afe8b
Instruction Fuzzy Hash: B821D619F0D75261E970EAD764717B927D8AF85BC4F040039EE4D6BB83EE6DE4828B40

Function 00007FFD9392E310 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD938E1307: OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD9394D40C

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD9392E342
ERR_new.LIBCRYPTO-3 ref: 00007FFD9392E39B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9392E3B3
ERR_new.LIBCRYPTO-3 ref: 00007FFD9392E3F4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9392E40C

Part of subcall function 00007FFD938E163B: ERR_new.LIBCRYPTO-3 ref: 00007FFD9394CF9B
Part of subcall function 00007FFD938E163B: ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394CFB3

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FFD9392E3AC, 00007FFD9392E405
tls_construct_certificate_authorities, xrefs: 00007FFD9392E3A0, 00007FFD9392E3F9

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$L_sk_num
String ID: ..\s\ssl\statem\extensions.c$tls_construct_certificate_authorities
API String ID: 2899912155-903051733
Opcode ID: b9df21bb734bebf1789b37818d0d66caccf0502b66ff8aafcd004ca205a0a710
Instruction ID: f526c9e2f5369fb31b02dea00a8c8cb0c9e0e6b4e22fc7122f1e096c357f81c6
Opcode Fuzzy Hash: b9df21bb734bebf1789b37818d0d66caccf0502b66ff8aafcd004ca205a0a710
Instruction Fuzzy Hash: 8B318421F1868251F7B4A792F9617BA5398AF847C0F481031EE4E67BD6DE2CE9818700

Function 00007FFD9394E190 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,00007FFD9394E076), ref: 00007FFD9394E1D0
ERR_set_debug.LIBCRYPTO-3(?,00007FFD9394E076), ref: 00007FFD9394E1E8
i2d_X509.LIBCRYPTO-3(?,00007FFD9394E076), ref: 00007FFD9394E21A

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD9394E1E1, 00007FFD9394E280
ssl_add_cert_to_wpacket, xrefs: 00007FFD9394E1D5, 00007FFD9394E274

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugX509i2d_
String ID: ..\s\ssl\statem\statem_lib.c$ssl_add_cert_to_wpacket
API String ID: 3356145284-2373850725
Opcode ID: 1bf72f7a9a418b59947d639660ac768812c716816504b6269ac81f9014ef3c15
Instruction ID: b80e98cc12877292a5ef246939319bde45ff54164513d252e0004b4296928791
Opcode Fuzzy Hash: 1bf72f7a9a418b59947d639660ac768812c716816504b6269ac81f9014ef3c15
Instruction Fuzzy Hash: AE318165F0C75262F774ABE2E8647AA6358AB84BC0F444132ED4DA7B95DF2CE540C740

Function 00007FFD938E106E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93953DF3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93953E0B
ERR_new.LIBCRYPTO-3 ref: 00007FFD93953E4E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93953E66

Strings

tls_post_process_client_key_exchange, xrefs: 00007FFD93953E53
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93953E04, 00007FFD93953E5F
ossl_statem_server_post_process_message, xrefs: 00007FFD93953DF8

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$ossl_statem_server_post_process_message$tls_post_process_client_key_exchange
API String ID: 193678381-715354105
Opcode ID: c015cf87a1d6c59d76f62471f3f2b99463cc2c3256abcc23cd98aa0413742e66
Instruction ID: 73c338774caa5b2a9535fed2b06cbc87fb6ac056fafcc2555c77f8c4bea21bd1
Opcode Fuzzy Hash: c015cf87a1d6c59d76f62471f3f2b99463cc2c3256abcc23cd98aa0413742e66
Instruction Fuzzy Hash: 9221D562F1820266F374A7F4D8A67F813889F84714F944431D90DA22D2DF2DE9C6C710

Function 00007FFD938E11C2 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9393BDC3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393BDDB
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393BE16
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393BE22
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393BE3A

Strings

tls_parse_ctos_maxfragmentlen, xrefs: 00007FFD9393BDCD, 00007FFD9393BE27
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD9393BDD4, 00007FFD9393BE33

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_maxfragmentlen
API String ID: 476316267-2768509386
Opcode ID: 00e72c825b025b49b59382b8093530e5ecf1248ef624fda0ae2378351fb25927
Instruction ID: 1e48f17ce7e3839e1b7e6da7d858361aaf5ba9552f36e2df2e9a3d18035c1545
Opcode Fuzzy Hash: 00e72c825b025b49b59382b8093530e5ecf1248ef624fda0ae2378351fb25927
Instruction Fuzzy Hash: C42193E6F09686A2F7B5ABE1E8613F92398EF80744F544031DA1E277D2DE2C99D1C700

Function 00007FFD939556D0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93955713
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9395572B

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93955724, 00007FFD9395577A
p, xrefs: 00007FFD939556E9
ssl_check_srp_ext_ClientHello, xrefs: 00007FFD93955718, 00007FFD9395576E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$p$ssl_check_srp_ext_ClientHello
API String ID: 193678381-2953162070
Opcode ID: a724ffa4adbff50ed23554cac04d888e0867ab1b44ce4ea7118337f94584a7b0
Instruction ID: 29ffc07b0ec709ce91070b65c70ce8229404f2d694f477bc9b305ac0ac7cc5f7
Opcode Fuzzy Hash: a724ffa4adbff50ed23554cac04d888e0867ab1b44ce4ea7118337f94584a7b0
Instruction Fuzzy Hash: 2B21D562F1924292F770A7E4E4657B92344EF84714F940131ED0EAA6D2EF2CE8C1CB00

Function 00007FFD938E237E Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93935643
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393565B
ERR_new.LIBCRYPTO-3 ref: 00007FFD93935696
ERR_new.LIBCRYPTO-3 ref: 00007FFD939356A2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939356BA

Strings

tls_parse_stoc_maxfragmentlen, xrefs: 00007FFD9393564D, 00007FFD939356A7
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93935654, 00007FFD939356B3

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_parse_stoc_maxfragmentlen
API String ID: 476316267-2494698823
Opcode ID: d8a5845e12814c52d556ae87b962f841879b70cfb8b58c889c854b5485bc3b70
Instruction ID: bf72e81e12e69372ddf45fdc949ebfd6e237265ad01cbe9d23882db20ddd60de
Opcode Fuzzy Hash: d8a5845e12814c52d556ae87b962f841879b70cfb8b58c889c854b5485bc3b70
Instruction Fuzzy Hash: 1E1181A1F0968662F775A7E0E8613FA2398EF44B40F944432DA0E277D2DE2CA9D5C700

Function 00007FFD938E1753 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939042A9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939042C1
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93904366

Strings

SSL_shutdown, xrefs: 00007FFD939042AE, 00007FFD93904342
..\s\ssl\ssl_lib.c, xrefs: 00007FFD939042BA, 00007FFD9390434E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_shutdown
API String ID: 1552677711-3410285451
Opcode ID: a75337dd072e9d2ea19a9817325d218080fb3d66144d97d4ed167f07bb11ddc1
Instruction ID: 6f7a0afc607649498d3b43a31a4cda4b7473c6807f38366f00b938160d0f5c8f
Opcode Fuzzy Hash: a75337dd072e9d2ea19a9817325d218080fb3d66144d97d4ed167f07bb11ddc1
Instruction Fuzzy Hash: 2E219D6AF18746A2F730ABE0E4613BA2358FF84748F940131E98D366D2DF3CE580CA40

Function 00007FFD9394D835 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

OPENSSL_sk_new.LIBCRYPTO-3 ref: 00007FFD9394D86C
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394D87B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394D893
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFD9394D95E
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD9394D97A
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FFD9394DA5A
X509_NAME_free.LIBCRYPTO-3 ref: 00007FFD9394DA62

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD9394D88C
parse_ca_names, xrefs: 00007FFD9394D885

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_pop_free$E_freeL_sk_newL_sk_pushR_newR_set_debugX509_
String ID: ..\s\ssl\statem\statem_lib.c$parse_ca_names
API String ID: 3454744561-1744826974
Opcode ID: 04ddb308f44a95e164a7bc128782d027c77922fadf66ae16df02d4ebe5c69b21
Instruction ID: 8f11202c98f0206109eb01e9a5ac49a3ed38dd9e6aef0b1778cea0ee6219bc95
Opcode Fuzzy Hash: 04ddb308f44a95e164a7bc128782d027c77922fadf66ae16df02d4ebe5c69b21
Instruction Fuzzy Hash: 19019E1AB0D64274F6A4BBE6EC717AB6358AF847C4F444431ED4D23B92DE3CE5868B40

Function 00007FFD939057A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD939057C3
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD939057D5
ERR_new.LIBCRYPTO-3 ref: 00007FFD939057ED
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93905805
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93905816

Strings

ct_strict, xrefs: 00007FFD939057F2
..\s\ssl\ssl_lib.c, xrefs: 00007FFD939057FE

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_numL_sk_valueR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ct_strict
API String ID: 2392307641-4060112342
Opcode ID: 4533c9fab320a86e9a286d2274cf84dd3800ab5d49d8415c502bd591c6c9f230
Instruction ID: 06827c5d652f76858a91434f73ba047cd3ecfa5ad66e8293b07814989b54ff1d
Opcode Fuzzy Hash: 4533c9fab320a86e9a286d2274cf84dd3800ab5d49d8415c502bd591c6c9f230
Instruction Fuzzy Hash: 8B019629F1C74261F7B4A7E9A4A13AA5354EF847C0F945031FD5D67B96EE2CD8818B00

Function 00007FFD9394F580 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9394F59E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394F5B6
EVP_MD_CTX_copy_ex.LIBCRYPTO-3 ref: 00007FFD9394F5DF
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394F5E8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394F600

Strings

tls13_restore_handshake_digest_for_pha, xrefs: 00007FFD9394F5A3, 00007FFD9394F5ED
..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD9394F5AF, 00007FFD9394F5F9

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug$X_copy_ex
String ID: ..\s\ssl\statem\statem_lib.c$tls13_restore_handshake_digest_for_pha
API String ID: 3813578642-2862071989
Opcode ID: cc85d45ec69b2fe8d2e568d824f8db917588606204a57535e552233c511a2a3d
Instruction ID: 743a32252eca60cd9ab0ffd3e5915d43004aee23ec1e8788a3a40d3a21d90b6c
Opcode Fuzzy Hash: cc85d45ec69b2fe8d2e568d824f8db917588606204a57535e552233c511a2a3d
Instruction Fuzzy Hash: 36015EA9F19242A2FBB4E7E1D875BF91358AF94380F844031DD0D676D2EE2DA9918B00

Function 00007FFD9390A6B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

d2i_PrivateKey_ex.LIBCRYPTO-3 ref: 00007FFD9390A6ED
ERR_new.LIBCRYPTO-3 ref: 00007FFD9390A6FA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390A712
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9390A722
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD9390A748

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFD9390A70B
SSL_use_PrivateKey_ASN1, xrefs: 00007FFD9390A6FF

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: Key_exPrivateR_newR_set_debugR_set_errorY_freed2i_
String ID: ..\s\ssl\ssl_rsa.c$SSL_use_PrivateKey_ASN1
API String ID: 3030233885-3334455494
Opcode ID: af7538087e6b9d2ece4810e187fc112cdef763de443be325085e7a9a76417a86
Instruction ID: d48187002d64ebbc182e793ac35d43d92e26cc794bea80207f6623f567acae31
Opcode Fuzzy Hash: af7538087e6b9d2ece4810e187fc112cdef763de443be325085e7a9a76417a86
Instruction Fuzzy Hash: 8501C466B19B4191E760EBA9E5503EE63A4FF897C4F940031EF8C53B96DE3CD1948B00

Function 00007FFD938E20C2 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

EVP_PKEY_get_security_bits.LIBCRYPTO-3 ref: 00007FFD938FD97C
ERR_new.LIBCRYPTO-3 ref: 00007FFD938FD99D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FD9B5
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FD9C6
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD938FD9E3

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD938FD9AE
SSL_CTX_set0_tmp_dh_pkey, xrefs: 00007FFD938FD9A2

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorY_freeY_get_security_bits
String ID: ..\s\ssl\ssl_lib.c$SSL_CTX_set0_tmp_dh_pkey
API String ID: 2486296959-3750284656
Opcode ID: b78ec14be19508be5f2ba3cb4a26e16aa11da7b85685c5e7afd526f49ea6ba3b
Instruction ID: db42f8420e6fe83fd19461dc729ae000e9b7fef758851c8bb2848247347818d4
Opcode Fuzzy Hash: b78ec14be19508be5f2ba3cb4a26e16aa11da7b85685c5e7afd526f49ea6ba3b
Instruction Fuzzy Hash: 0E01F566B1864291E760E7E4F9617FA63A8EF887C4F544031EE4C63BD6DE3CD9408B00

Function 00007FFD938E263F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

EVP_PKEY_get_security_bits.LIBCRYPTO-3 ref: 00007FFD939030AC
ERR_new.LIBCRYPTO-3 ref: 00007FFD939030CD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939030E5
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD939030F6
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FFD93903113

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD939030DE
SSL_set0_tmp_dh_pkey, xrefs: 00007FFD939030D2

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorY_freeY_get_security_bits
String ID: ..\s\ssl\ssl_lib.c$SSL_set0_tmp_dh_pkey
API String ID: 2486296959-3900076315
Opcode ID: 0663dbe0d9e2f24b4d42b00f9c6a5dfd65e6da1202bfe41ae48a83f1b03d5ee1
Instruction ID: aec5debd8ebe44af4f35d37521514aa5a3d9ab0f1770d3d3382f91f81bcd939b
Opcode Fuzzy Hash: 0663dbe0d9e2f24b4d42b00f9c6a5dfd65e6da1202bfe41ae48a83f1b03d5ee1
Instruction Fuzzy Hash: 1701B969B1C64161E760F7A5F9617BA63A8EF857C4F544031EE4C63BD6DE3CD5408B00

Function 00007FFD938E52E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

BIO_get_data.LIBCRYPTO-3 ref: 00007FFD938E532D
BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFD938E5340
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFD938E5385
BIO_set_retry_reason.LIBCRYPTO-3 ref: 00007FFD938E5425

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_clear_flagsO_get_dataO_set_flagsO_set_retry_reason
String ID:
API String ID: 3836630899-0
Opcode ID: e03d538e60a270bb7c9e6b1dbca698f7b36a3815dcc41f1296a6c0701146d666
Instruction ID: a0512070138ddcaeedb5c8e46b38a38a3fcc179951272bd59d4db914f038e280
Opcode Fuzzy Hash: e03d538e60a270bb7c9e6b1dbca698f7b36a3815dcc41f1296a6c0701146d666
Instruction Fuzzy Hash: EC41A766F0C21242E779BBA6A52167E6399EF81BC8F504031DD0C67B8ACE3DD9828740

Function 00007FFD938E1578 Relevance: 12.1, APIs: 8, Instructions: 104COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93901B23
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93901B33
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93901B54
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FFD93901B65
OPENSSL_sk_find.LIBCRYPTO-3 ref: 00007FFD93901B73
OPENSSL_strnlen.LIBCRYPTO-3 ref: 00007FFD93901B83
memcpy.VCRUNTIME140 ref: 00007FFD93901B9D
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FFD93901BBB

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_num$L_sk_findL_sk_valueL_strnlenmemcpy
String ID:
API String ID: 2509952571-0
Opcode ID: 423b726654964b2388d601fefa8885fe1dc2bb7bea55b20e942cd706f42b498f
Instruction ID: 088f66e7781ed9ad8814548eeab1309ef1ba97fdd6d36a0bd5a8e3c87270a1aa
Opcode Fuzzy Hash: 423b726654964b2388d601fefa8885fe1dc2bb7bea55b20e942cd706f42b498f
Instruction Fuzzy Hash: 75317A2FB0978354E631AA96A56637A6788BF42FD8F080030EE4D677A5DF3CE481C700

Function 00007FFD939065E0 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3(?,00007FFD93900061), ref: 00007FFD93906622
OPENSSL_sk_num.LIBCRYPTO-3(?,00007FFD93900061), ref: 00007FFD93906639
OPENSSL_sk_value.LIBCRYPTO-3(?,00007FFD93900061), ref: 00007FFD93906647
X509_NAME_dup.LIBCRYPTO-3(?,00007FFD93900061), ref: 00007FFD9390664F
OPENSSL_sk_num.LIBCRYPTO-3(?,00007FFD93900061), ref: 00007FFD93906673

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_num$E_dupL_sk_new_nullL_sk_valueX509_
String ID:
API String ID: 3273602126-0
Opcode ID: 696f9ce60301da99104408f8e4581387c970970da34e4d3e55ea35e57f899cbf
Instruction ID: c4c5db295273c0e9a4bcc761e768eabec0e0fbdce76f27d07a8abc304d0648dd
Opcode Fuzzy Hash: 696f9ce60301da99104408f8e4581387c970970da34e4d3e55ea35e57f899cbf
Instruction Fuzzy Hash: 1921C829B0D742A5EA70FBE694A037D5398EF54BC4F081030EE4D57B96DE3CE4818B00

Function 00007FFD938E228E Relevance: 12.1, APIs: 8, Instructions: 54COMMON

Download Yara Rule

APIs

BIO_s_connect.LIBCRYPTO-3 ref: 00007FFD938E61E6
BIO_new.LIBCRYPTO-3 ref: 00007FFD938E61EE
BIO_new.LIBCRYPTO-3 ref: 00007FFD938E6212
BIO_free.LIBCRYPTO-3 ref: 00007FFD938E6232
BIO_free.LIBCRYPTO-3 ref: 00007FFD938E626A
BIO_free.LIBCRYPTO-3 ref: 00007FFD938E6272

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_free$O_new$O_s_connect
String ID:
API String ID: 3895418919-0
Opcode ID: eb7f830061f6341aaed8e9ea6bde47c98f41d6a09f7d89c024111d808a6b4c4e
Instruction ID: 3d17841e6c9cf8c66a2657b331eb83aed32b11eb592ae4715bb412b28a9dd322
Opcode Fuzzy Hash: eb7f830061f6341aaed8e9ea6bde47c98f41d6a09f7d89c024111d808a6b4c4e
Instruction Fuzzy Hash: 3B115A45F0D74351FEB9B7E2A9312BA13885F85BC4F081034ED0E6BB86EE2DE4924B00

Function 00007FFD9394B560 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD9394B637

Part of subcall function 00007FFD938E1294: EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FFD9394A216
Part of subcall function 00007FFD938E1294: EVP_CIPHER_get_flags.LIBCRYPTO-3 ref: 00007FFD9394A21E
Part of subcall function 00007FFD938E1294: EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FFD9394A230
Part of subcall function 00007FFD938E1294: EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FFD9394A238
Part of subcall function 00007FFD938E1294: EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FFD9394A251
Part of subcall function 00007FFD938E1294: EVP_CIPHER_get_mode.LIBCRYPTO-3 ref: 00007FFD9394A259
Part of subcall function 00007FFD938E1294: EVP_CIPHER_CTX_get_block_size.LIBCRYPTO-3 ref: 00007FFD9394A26A
Part of subcall function 00007FFD938E1294: BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD9394A2EA

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD9394B767
ERR_new.LIBCRYPTO-3 ref: 00007FFD9394B7B3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394B7CB

Strings

dtls1_retransmit_message, xrefs: 00007FFD9394B7B8
..\s\ssl\statem\statem_dtls.c, xrefs: 00007FFD9394B7C4

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_ctrlX_get0_cipher$D_get_sizeR_get_flagsR_get_modeR_newR_set_debugX_get0_mdX_get_block_sizememcpy
String ID: ..\s\ssl\statem\statem_dtls.c$dtls1_retransmit_message
API String ID: 4032328484-3409696843
Opcode ID: 35c08ca5b6df72c29fcff8482bf295c2180412b58a38359ed8757325d35b4e9c
Instruction ID: 080946bdc6dd4debb56e74b1ae4b688402dae34c15567a8847ba0c263f75520f
Opcode Fuzzy Hash: 35c08ca5b6df72c29fcff8482bf295c2180412b58a38359ed8757325d35b4e9c
Instruction Fuzzy Hash: CF61BC32708B9492D7A8EB66E5907EA77A8FB88B80F414136EF9D43741CF39D4A0C700

Function 00007FFD938E21F3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFD9394162C
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFD93941639

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93941A20
ossl_statem_client_read_transition, xrefs: 00007FFD93941A14

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: ..\s\ssl\statem\statem_clnt.c$ossl_statem_client_read_transition
API String ID: 3946675294-211585089
Opcode ID: e96a28e129b909e6359b31ab0034dc2b12ab5a36858a46d44988d6aab555a2b4
Instruction ID: f440607cafd2e9546bd5d56a8e01995269f7b14b22053b37239fe1fe9e789d3d
Opcode Fuzzy Hash: e96a28e129b909e6359b31ab0034dc2b12ab5a36858a46d44988d6aab555a2b4
Instruction Fuzzy Hash: 19313B32B1C24292E774EBE5D4643BC2395EB48B88F184430DA0E977D5CE2DD581C700

Function 00007FFD938E22A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939363DB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939363F3
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393643D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93936455

Strings

tls_parse_stoc_status_request, xrefs: 00007FFD939363E0, 00007FFD93936442
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD939363EC, 00007FFD9393644E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_parse_stoc_status_request
API String ID: 193678381-3840607856
Opcode ID: 04bca72229bd47922c772432602eda02b164c51c0c4fda7c46eff59f9b5b601f
Instruction ID: 46da058d2ca15210ce41dc9a56eebe4e0b1f68361a5e4ba8c560cddaf124f2da
Opcode Fuzzy Hash: 04bca72229bd47922c772432602eda02b164c51c0c4fda7c46eff59f9b5b601f
Instruction Fuzzy Hash: B121C1A2F0824662FBBC97D1D8A87F923A8EF80714F644031D90DA76D1DE6DE9D1C701

Function 00007FFD9391B2B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 61COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FFD9391B2FD
BIO_printf.LIBCRYPTO-3 ref: 00007FFD9391B347

Strings

%s=0x%x (%s), xrefs: 00007FFD9391B340
cookie, xrefs: 00007FFD9391B374
server_version, xrefs: 00007FFD9391B336
UNKNOWN, xrefs: 00007FFD9391B321

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s=0x%x (%s)$UNKNOWN$cookie$server_version
API String ID: 1860387303-3219550004
Opcode ID: 64ca8e15f2fd70a2bc7e9583ff755a23efd2fa34a0515b12eecb7d8ed4e3806f
Instruction ID: f32a89f7552d462fdb4b99dc296a23144142b830aea97e28d81a75a1b822939b
Opcode Fuzzy Hash: 64ca8e15f2fd70a2bc7e9583ff755a23efd2fa34a0515b12eecb7d8ed4e3806f
Instruction Fuzzy Hash: 9C21B822B0DB9195E7308BD5E4652ADB7A9FB48780F444132EA8E33B95DF7CD512C700

Function 00007FFD939546FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9395470A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93954722
ERR_new.LIBCRYPTO-3 ref: 00007FFD9395475B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93954773

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD9395471B, 00007FFD9395476C
tls_process_end_of_early_data, xrefs: 00007FFD9395470F, 00007FFD93954760

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_end_of_early_data
API String ID: 193678381-3379596787
Opcode ID: beaa9cb0c1abfa1e1bc0eb669672cbfd1bed8cd5fffdc03fa174592bbe2adcfe
Instruction ID: f88110f285a04416fe8c1d6cb088ed0f181dc2703e57582d8d34c9016741af0c
Opcode Fuzzy Hash: beaa9cb0c1abfa1e1bc0eb669672cbfd1bed8cd5fffdc03fa174592bbe2adcfe
Instruction Fuzzy Hash: 3F119336B1824196E760EBE9E9217FD6355EFC0744F480032DE0E97296DEADD480C700

Function 00007FFD938E1168 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9393B5E9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393B601
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393B62B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393B643

Strings

tls_parse_ctos_early_data, xrefs: 00007FFD9393B5EE, 00007FFD9393B630
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD9393B5FA, 00007FFD9393B63C

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_early_data
API String ID: 193678381-408386505
Opcode ID: 0cf50f3f80cca980f84d80de7a713fbca74cd6b952973251a9bf5ba5733eb537
Instruction ID: cf6a62cd6b3101921b7c0b063519926a036da92701c15ac4296bc0b08bbac49d
Opcode Fuzzy Hash: 0cf50f3f80cca980f84d80de7a713fbca74cd6b952973251a9bf5ba5733eb537
Instruction Fuzzy Hash: 35016295F08242A2F774A7E0D8793F6139C9F44314F944031D90E666D2DF2CA9D2CA00

Function 00007FFD93921454 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

EC_KEY_get0_group.LIBCRYPTO-3 ref: 00007FFD9392147C
ERR_new.LIBCRYPTO-3 ref: 00007FFD93921486
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9392149E
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD939214AF

Strings

..\s\ssl\tls_depr.c, xrefs: 00007FFD93921497
ssl_set_tmp_ecdh_groups, xrefs: 00007FFD9392148B

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorY_get0_group
String ID: ..\s\ssl\tls_depr.c$ssl_set_tmp_ecdh_groups
API String ID: 2690379533-3926364423
Opcode ID: 68489a538686b752c9f2948f9d1530e8915f1fc4dfe4fbf8939f8a3c3b18f5ad
Instruction ID: 08466630d0264e5b8359dbe02db6e36597632696c9fd81f6f49580715e000dd3
Opcode Fuzzy Hash: 68489a538686b752c9f2948f9d1530e8915f1fc4dfe4fbf8939f8a3c3b18f5ad
Instruction Fuzzy Hash: B2F0E255B1824272E7A0E7E1E8213FA23599F58380F900031E80C63BD3EE2CD5804B01

Function 00007FFD93915160 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FFD939151B3
EVP_PKEY_get_security_bits.LIBCRYPTO-3 ref: 00007FFD939151C0
X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FFD93915202
EVP_PKEY_get_security_bits.LIBCRYPTO-3 ref: 00007FFD9391520F
X509_get_extension_flags.LIBCRYPTO-3 ref: 00007FFD93915253
X509_get_signature_info.LIBCRYPTO-3 ref: 00007FFD93915283

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: X509_get0_pubkeyY_get_security_bits$X509_get_extension_flagsX509_get_signature_info
String ID:
API String ID: 3836818763-0
Opcode ID: 881e7ae5a45f0a571fb5a722c38be3c32f9cab0c888addf428be226d2df2081b
Instruction ID: 34a2cd4024cf1d2ed73c065fac497e33b9d7e529c2cbad0b4022659cd0c650d9
Opcode Fuzzy Hash: 881e7ae5a45f0a571fb5a722c38be3c32f9cab0c888addf428be226d2df2081b
Instruction Fuzzy Hash: BA41B722B0C28255FA75AED6A421BBA9788BF98784F554431ED4D7BBC6DF3CE4408B00

Function 00007FFD938E16EA Relevance: 9.1, APIs: 6, Instructions: 63COMMON

Download Yara Rule

APIs

BIO_next.LIBCRYPTO-3 ref: 00007FFD93903650
BIO_up_ref.LIBCRYPTO-3 ref: 00007FFD9390366D
BIO_next.LIBCRYPTO-3 ref: 00007FFD93903681
BIO_next.LIBCRYPTO-3 ref: 00007FFD9390369A
BIO_free_all.LIBCRYPTO-3 ref: 00007FFD939036AE
BIO_free_all.LIBCRYPTO-3 ref: 00007FFD939036CB

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_next$O_free_all$O_up_ref
String ID:
API String ID: 1216991848-0
Opcode ID: 0aa353734cd2757dcafc435e18f9e496c362ffaffce6a2e2fac3e9d2a8b7e651
Instruction ID: 480333207d606eeab9cd0c9820cd5038572a6cd6607023fba045586516b73f61
Opcode Fuzzy Hash: 0aa353734cd2757dcafc435e18f9e496c362ffaffce6a2e2fac3e9d2a8b7e651
Instruction Fuzzy Hash: BE21711AB1AA4291EEB4BBD5D1A223C5368FF44FC4F440531DE4E37B99CE2CE8918700

Function 00007FFD93905320 Relevance: 9.0, APIs: 6, Instructions: 33COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_free.LIBCRYPTO-3(?,00007FFD938FF27A), ref: 00007FFD93905344
EVP_CIPHER_CTX_free.LIBCRYPTO-3(?,00007FFD938FF27A), ref: 00007FFD9390535C
COMP_CTX_free.LIBCRYPTO-3(?,00007FFD938FF27A), ref: 00007FFD9390536F
COMP_CTX_free.LIBCRYPTO-3(?,00007FFD938FF27A), ref: 00007FFD93905382
EVP_MD_CTX_free.LIBCRYPTO-3(?,00007FFD938FF27A), ref: 00007FFD93905395
EVP_MD_CTX_free.LIBCRYPTO-3(?,00007FFD938FF27A), ref: 00007FFD939053A8

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: X_free
String ID:
API String ID: 2268491255-0
Opcode ID: 9ebb44a18d46cd6d82ab736cafde8de4ff649955874f619762421e4823475d1b
Instruction ID: 4e19cab966c28cda72350149a1dc11e18a32ae0d4406af47ae8cc8b2dd0da730
Opcode Fuzzy Hash: 9ebb44a18d46cd6d82ab736cafde8de4ff649955874f619762421e4823475d1b
Instruction Fuzzy Hash: AF014036708B81D0D754AFE2D4A03A863E8FF90F84F488135DE8D5A6AACE28C0928750

Function 00007FFD93916310 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939163FE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93916416
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93916425

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FFD9391640F
tls12_copy_sigalgs, xrefs: 00007FFD93916403

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\t1_lib.c$tls12_copy_sigalgs
API String ID: 1552677711-2872464142
Opcode ID: 980a02a6581a01fbe6dc403342e0bf76759dcebfcdda83b0d3c88b9f4d256004
Instruction ID: 618c82c60e7923dbe35e16295b888b327961a1fd67e4e65168413aad82a3581c
Opcode Fuzzy Hash: 980a02a6581a01fbe6dc403342e0bf76759dcebfcdda83b0d3c88b9f4d256004
Instruction Fuzzy Hash: 0031DE22F08252A1E770DBD5D5A477A23A8EB48B88F584431EE88776C5DF3CE882C750

Function 00007FFD9391E6E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3(FFFFFFFE,00000000,0000004D,00007FFD9391E5C1,?,?,?,?,?,?,?,00007FFD9391D7CC), ref: 00007FFD9391E752
BIO_printf.LIBCRYPTO-3(FFFFFFFE,00000000,0000004D,00007FFD9391E5C1,?,?,?,?,?,?,?,00007FFD9391D7CC), ref: 00007FFD9391E78B

Strings

Signature, xrefs: 00007FFD9391E7C6
Signature Algorithm: %s (0x%04x), xrefs: 00007FFD9391E781
UNKNOWN, xrefs: 00007FFD9391E771

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_indentO_printf
String ID: Signature$Signature Algorithm: %s (0x%04x)$UNKNOWN
API String ID: 1860387303-3399393549
Opcode ID: 1fe9459a3b0e58aa9dde9dad7f9a90a73c342d53d064fb4b9bf4dcef0591f6d8
Instruction ID: 190a4ef9665e4f306d90b6b1cee9ab50aa0cc84bcd23cf5342c36464472a70e0
Opcode Fuzzy Hash: 1fe9459a3b0e58aa9dde9dad7f9a90a73c342d53d064fb4b9bf4dcef0591f6d8
Instruction Fuzzy Hash: D931D623B08B9096E720DF9AE4252A977A5F788BA0F494232EEAD137D1DF3CD041C700

Function 00007FFD938E1453 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9393A471
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393A47D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393A495

Strings

tls_construct_stoc_supported_versions, xrefs: 00007FFD9393A487
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD9393A48E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_construct_stoc_supported_versions
API String ID: 476316267-1917491940
Opcode ID: c659e60a4cb5b7cfb9d646d06c25c46f0c530abaf28ab41a8ad4c29e66aed8cd
Instruction ID: f2e23790041d729782358264e47a370c1457c0fcd51e902992e2c228064debbd
Opcode Fuzzy Hash: c659e60a4cb5b7cfb9d646d06c25c46f0c530abaf28ab41a8ad4c29e66aed8cd
Instruction Fuzzy Hash: FC21C892B0C24362F778A7E5E9797B913999F847C0F444031DE5E976E2DE2FE8818701

Function 00007FFD938F9410 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

OPENSSL_strcasecmp.LIBCRYPTO-3 ref: 00007FFD938F9445
OPENSSL_strcasecmp.LIBCRYPTO-3 ref: 00007FFD938F9458

Strings

+automatic, xrefs: 00007FFD938F943B
automatic, xrefs: 00007FFD938F944E
auto, xrefs: 00007FFD938F946A

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_strcasecmp
String ID: +automatic$auto$automatic
API String ID: 4194642261-1892669398
Opcode ID: 119b423f726b6808b0a7a4277664e31be03bf93c97af1285d5ef739f9ec5cf63
Instruction ID: ddb25ed582927f93de39896f396cef11feaee75a55a1d9f630bdeadf8e007f56
Opcode Fuzzy Hash: 119b423f726b6808b0a7a4277664e31be03bf93c97af1285d5ef739f9ec5cf63
Instruction Fuzzy Hash: AB21F726F0EB5241EB749B95E4202797359AFA1BC0F484831EE4E27786DE2DEA148780

Function 00007FFD938E1794 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9393D188
ERR_new.LIBCRYPTO-3 ref: 00007FFD9393D19F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393D1B7

Strings

tls_parse_ctos_sig_algs_cert, xrefs: 00007FFD9393D1A9
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD9393D1B0

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_sig_algs_cert
API String ID: 476316267-1840853530
Opcode ID: 1073be0a9b484ce19d832c05d5a2653f12d436c50a18cc8e4b4aec750ab669b4
Instruction ID: ea1bd43af589d594197f18acf79f3583bd0e6af8118f9a21cde91497d4d524fa
Opcode Fuzzy Hash: 1073be0a9b484ce19d832c05d5a2653f12d436c50a18cc8e4b4aec750ab669b4
Instruction Fuzzy Hash: 8121AA62F1C69657E7786BE4E8317BA6399EB94344F044131E98D56691DF3CE2D0CB00

Function 00007FFD9391D6E6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FFD9391D708
BIO_printf.LIBCRYPTO-3 ref: 00007FFD9391D744

Strings

%s=0x%x (%s), xrefs: 00007FFD9391D73D
cookie, xrefs: 00007FFD9391D773
server_version, xrefs: 00007FFD9391D733

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s=0x%x (%s)$cookie$server_version
API String ID: 1860387303-2821402668
Opcode ID: cdcd296945ee0c6af791d258c8f2ca5dcabc6c3aa595190e87285eab1cdc08fc
Instruction ID: deede911bf6864374ce87f208a92d1ed79df125477d61ad1064623b17f27b452
Opcode Fuzzy Hash: cdcd296945ee0c6af791d258c8f2ca5dcabc6c3aa595190e87285eab1cdc08fc
Instruction Fuzzy Hash: 48112763B1C69264E630ABC8E4242B9735AEB85BB0F444232D96E377E5DE3CD482C304

Function 00007FFD938E2234 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93903959
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93903971
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD93903982

Strings

SSL_set_ct_validation_callback, xrefs: 00007FFD9390395E
..\s\ssl\ssl_lib.c, xrefs: 00007FFD9390396A

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_set_ct_validation_callback
API String ID: 1552677711-4238296029
Opcode ID: 8462e2679c906cc9e36448615c1024ad7288fc3c80b789c1f52a7dda222a32f6
Instruction ID: cdab27e34ec1365a124e88b72c241a709d9c11444e520bf0c70a838a6a0b8a48
Opcode Fuzzy Hash: 8462e2679c906cc9e36448615c1024ad7288fc3c80b789c1f52a7dda222a32f6
Instruction Fuzzy Hash: AA11A736B1868291E7A0DB95E8507AD73A8FF84BC4F584131EE8D67B95DF2DD841C700

Function 00007FFD938E22E3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FFD938E79B0
ERR_new.LIBCRYPTO-3 ref: 00007FFD938E79DF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938E79F7

Strings

dtls1_check_timeout_num, xrefs: 00007FFD938E79E4
..\s\ssl\d1_lib.c, xrefs: 00007FFD938E79F0

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_ctrlR_newR_set_debug
String ID: ..\s\ssl\d1_lib.c$dtls1_check_timeout_num
API String ID: 2442628283-2777391390
Opcode ID: ece99f8b41be008867fb24bbc8c5f3b11974ce740c8e357ce5a1e4c914765ca1
Instruction ID: 49edcb5b7950954685ec73d3642e42e6c00eba4b5fc9100188e8b3f9f82effd3
Opcode Fuzzy Hash: ece99f8b41be008867fb24bbc8c5f3b11974ce740c8e357ce5a1e4c914765ca1
Instruction Fuzzy Hash: 7D11A076B1828291EBB8BBE5D8657FD23A9EF84B40F440135EE1D27792CF2D9580C710

Function 00007FFD938E15EB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9390C26F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390C287
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9390C297

Strings

..\s\ssl\ssl_rsa_legacy.c, xrefs: 00007FFD9390C280
SSL_CTX_use_RSAPrivateKey_ASN1, xrefs: 00007FFD9390C274

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_rsa_legacy.c$SSL_CTX_use_RSAPrivateKey_ASN1
API String ID: 1552677711-3275896764
Opcode ID: 9e56ce5bafe41f2b96d3e62e59f2184fb4715dd5390d44e28bd56edd0f1eaa74
Instruction ID: 69d03e65512ea323d2f970272c315f1125457aaa5659d4c98d2b8c20eeabcfcf
Opcode Fuzzy Hash: 9e56ce5bafe41f2b96d3e62e59f2184fb4715dd5390d44e28bd56edd0f1eaa74
Instruction Fuzzy Hash: 8501A755B1C30262EA64B7E5F5613B95398EF483C0F540032FA4E67BD7DD2CD4808B00

Function 00007FFD938E10F5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD938E96CA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938E96E0
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938E96F0

Strings

pqueue_new, xrefs: 00007FFD938E96CF
..\s\ssl\pqueue.c, xrefs: 00007FFD938E96B3, 00007FFD938E96D9

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\pqueue.c$pqueue_new
API String ID: 1552677711-2823724430
Opcode ID: 4fec400a62d84a03df9aedca83976200def0fce04fbe909b966fde54edf37fc4
Instruction ID: 3b146ad6ecb8ad1563eee5912aed2614b3009205b47a31b6a6d98c3251165378
Opcode Fuzzy Hash: 4fec400a62d84a03df9aedca83976200def0fce04fbe909b966fde54edf37fc4
Instruction Fuzzy Hash: 49F0BE65B0A203A5EB34BFE0E420BF92328AF44708F800035DC0C266A2EE2CF695CB40

Function 00007FFD938ED0EC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD938ED0F1
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938ED109
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938ED119

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFD938ED102
ssl3_ctrl, xrefs: 00007FFD938ED0F6

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\s3_lib.c$ssl3_ctrl
API String ID: 1552677711-3079590724
Opcode ID: a860d735f6fe460b9ed38740efebbfc35dfccece810951fad2f9c33abfa7f6eb
Instruction ID: 857bf068fa7672c0f0667570313a2716a2840927569dee3f33f062e972c057d7
Opcode Fuzzy Hash: a860d735f6fe460b9ed38740efebbfc35dfccece810951fad2f9c33abfa7f6eb
Instruction Fuzzy Hash: BBF0E21AB0C642E5F374FBE4E0202FA2318EF44790F840032CE0D32A869F2DE989C710

Function 00007FFD938E2419 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93909552
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9390956A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9390957B

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FFD93909563
SSL_CTX_use_PrivateKey, xrefs: 00007FFD93909557

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_rsa.c$SSL_CTX_use_PrivateKey
API String ID: 1552677711-4052895991
Opcode ID: 2db8c2c8c9cf176edf010fd05d8a89cb4bab678f973f7b3dc051a121d1e1995f
Instruction ID: 08adca7b68a0036dd13b9b37546033747086f85aefa78014940a62a5d0065eb0
Opcode Fuzzy Hash: 2db8c2c8c9cf176edf010fd05d8a89cb4bab678f973f7b3dc051a121d1e1995f
Instruction Fuzzy Hash: 17E06559F1A602A1F774A3F488367F91355AF94304FA04031D90D726D2EE1CA5868640

Function 00007FFD939133F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93913402
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9391341A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9391342B

Strings

SSL_set_tlsext_max_fragment_length, xrefs: 00007FFD93913407
..\s\ssl\t1_lib.c, xrefs: 00007FFD93913413

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\t1_lib.c$SSL_set_tlsext_max_fragment_length
API String ID: 1552677711-2316233728
Opcode ID: 9ed479348e7acf0d09b4a017a7bde8f21df55abddd4617647bbf75be60f4deba
Instruction ID: e7ef11cc0e937e4e80a3116ce27cb997db20585fed85bfa1438226ba86172a15
Opcode Fuzzy Hash: 9ed479348e7acf0d09b4a017a7bde8f21df55abddd4617647bbf75be60f4deba
Instruction Fuzzy Hash: 7EE09259F19181A2F3A0F3F4D8667EA1355AB50300FD04030E40D326D3DE1CA58A8A01

Function 00007FFD93913150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93913162
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9391317A
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD9391318B

Strings

SSL_CTX_set_tlsext_max_fragment_length, xrefs: 00007FFD93913167
..\s\ssl\t1_lib.c, xrefs: 00007FFD93913173

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\t1_lib.c$SSL_CTX_set_tlsext_max_fragment_length
API String ID: 1552677711-1180925554
Opcode ID: a2ccf03ef1e851bf608a7eabc95ac11aa916ea27bfcf4fac2c59953d6929bc0a
Instruction ID: 00dddd88bd8e728b0ad77319de220936024402a7e94729384830a05fc24bb604
Opcode Fuzzy Hash: a2ccf03ef1e851bf608a7eabc95ac11aa916ea27bfcf4fac2c59953d6929bc0a
Instruction Fuzzy Hash: 37E09259F19585A2F3A4B3F8D86A3EA1359AF90301FE04431E00D326D3ED1CA68A8B01

Function 00007FFD938ED0A2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD938ED0A2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938ED0BA
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938ED0CB

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FFD938ED0B3
ssl3_ctrl, xrefs: 00007FFD938ED0A7

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\s3_lib.c$ssl3_ctrl
API String ID: 1552677711-3079590724
Opcode ID: 331e23a8593135e9122189d94e75dd2e319d85b15da77aefea71476a8b35d0aa
Instruction ID: e86435db682a46ec6503e777efbca95ba772c61ee507f11104d9d7820dbf0042
Opcode Fuzzy Hash: 331e23a8593135e9122189d94e75dd2e319d85b15da77aefea71476a8b35d0aa
Instruction Fuzzy Hash: 49E04F1AB1D502A5E3B0E7E4E4216EA2325EB443A4F940032DE0D22696DE2DE8C6DB40

Function 00007FFD938E1445 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD938FBCBD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD938FBCD5
ERR_set_error.LIBCRYPTO-3 ref: 00007FFD938FBCE6

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FFD938FBCCE
ssl_undefined_function, xrefs: 00007FFD938FBCC2

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_undefined_function
API String ID: 1552677711-2204979087
Opcode ID: eb668bfcb294817dc9ac1ed38ec7e655d6b9154359c3840f46d898fa57ace209
Instruction ID: 27141e8e433a421f46e826ad9d30ab102f499e66907bdd32d3de164c6fcb7dee
Opcode Fuzzy Hash: eb668bfcb294817dc9ac1ed38ec7e655d6b9154359c3840f46d898fa57ace209
Instruction Fuzzy Hash: CAE0BF59F29246A6E370F7E0D8667FA2358AB50310FD04031E50D636D2DE2DA5858B40

Function 00007FFD93907569 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EVP_CIPHER_get0_provider.LIBCRYPTO-3 ref: 00007FFD93907572
ERR_set_mark.LIBCRYPTO-3 ref: 00007FFD939075DC
OBJ_nid2sn.LIBCRYPTO-3 ref: 00007FFD939075E3
EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FFD939075F1
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFD939075F9

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: D_fetchJ_nid2snR_get0_providerR_pop_to_markR_set_mark
String ID:
API String ID: 2255186618-0
Opcode ID: 7194dbe5204d18a8701bfccbbb21cc035255ebbdc26918a4116d2f00c3ab87c5
Instruction ID: e0cb2d0f61b96a0bd2bec931e4db09fa0c971628a5c8bf99027fd0200643f870
Opcode Fuzzy Hash: 7194dbe5204d18a8701bfccbbb21cc035255ebbdc26918a4116d2f00c3ab87c5
Instruction Fuzzy Hash: 01018F56F0E34252FA7977E694613BC12598F58B80F481434EE0E777C7EC2DF9914A40

Function 00007FFD938E2518 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFD938F15F8
X509_get_subject_name.LIBCRYPTO-3 ref: 00007FFD938F160C
X509_NAME_dup.LIBCRYPTO-3 ref: 00007FFD938F1614
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFD938F162B
X509_NAME_free.LIBCRYPTO-3 ref: 00007FFD938F1637

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: X509_$E_dupE_freeL_sk_new_nullL_sk_pushX509_get_subject_name
String ID:
API String ID: 2231116090-0
Opcode ID: b707467de0e1d467bf08f39588a23152d1c84b8d386ac6a80151553d34bc738a
Instruction ID: 005144e05660140d01d09b844d275dbc8f41883f0c34da0c4af25b0b3f65f249
Opcode Fuzzy Hash: b707467de0e1d467bf08f39588a23152d1c84b8d386ac6a80151553d34bc738a
Instruction Fuzzy Hash: 57016969F0E74240EEB5A7E6A2753B95298AF5CBC0F4C0131ED4C5B7C6FE2DE8914A40

Function 00007FFD9395356F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9395385C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93953874

Strings

ossl_statem_server13_write_transition, xrefs: 00007FFD93953861
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD9395386D

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$ossl_statem_server13_write_transition
API String ID: 193678381-3318936413
Opcode ID: 6efa294c1ad19f707bf2ef4ad857f38fbf02fc170b61755b2bafccc7db413706
Instruction ID: 593adad5f20f5aa79047063bb28bf41b56a5c5b82b186a5bb0cad9eb6e706a67
Opcode Fuzzy Hash: 6efa294c1ad19f707bf2ef4ad857f38fbf02fc170b61755b2bafccc7db413706
Instruction Fuzzy Hash: 1901CCE3F19241D7E360A3E4ECBE7AF2364DB24384F8A5430DA09923D2E92CE1418702

Function 00007FFD938E10AA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93933A3D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93933A55

Strings

tls_construct_ctos_sig_algs, xrefs: 00007FFD93933A42
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93933A4E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_sig_algs
API String ID: 193678381-4035473336
Opcode ID: 93acb5a60f194efea92f892e52a2113056a595ac35d7cd52714ab02f45be1271
Instruction ID: 29bf9d6b1f08ca81c7d1effbd1dda2d317d9b1746c1bcfff9837f3c84fccd416
Opcode Fuzzy Hash: 93acb5a60f194efea92f892e52a2113056a595ac35d7cd52714ab02f45be1271
Instruction Fuzzy Hash: 99318991B1C28391F774A792D9A13F96359EF847D4F580031ED4DA7BD6DE2DD8428700

Function 00007FFD938E2680 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD939336A7
tls_construct_ctos_server_name, xrefs: 00007FFD9393369B

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_server_name
API String ID: 0-1970769450
Opcode ID: 34511d4b9de82d24d5ece8db136f53805f6cceb319a47cd89415a3a91dad916c
Instruction ID: 62b3549c6767ec19c6c6a501fd784b8514994bab4aa52bb1b04845f430cd1623
Opcode Fuzzy Hash: 34511d4b9de82d24d5ece8db136f53805f6cceb319a47cd89415a3a91dad916c
Instruction Fuzzy Hash: 4431A751F9C24365FBB8B7A6E9667B91389AF807C4F485430DD0E57BC6EE5DE4808700

Function 00007FFD938E23D3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD93933BC3
tls_construct_ctos_srp, xrefs: 00007FFD93933BB7

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_srp
API String ID: 0-2342567248
Opcode ID: 943edc0e63e99509b6e1097d3a36206b7d29b06efda21a5f0624fff267cc6705
Instruction ID: 4db15b82c1bdb551e1f8115c3c36a1b1499935149504e59a02999b4c64fe08c4
Opcode Fuzzy Hash: 943edc0e63e99509b6e1097d3a36206b7d29b06efda21a5f0624fff267cc6705
Instruction Fuzzy Hash: 35216251F5C24361FB78ABA6E9617B913A8EF807C0F581030DD8E5BBC6DE6DE8808740

Function 00007FFD9391B140 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FFD9391B1CE
BIO_printf.LIBCRYPTO-3 ref: 00007FFD9391B204

Strings

%s (%d), xrefs: 00007FFD9391B1FA
UNKNOWN, xrefs: 00007FFD9391B1F0

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s (%d)$UNKNOWN
API String ID: 1860387303-2251275378
Opcode ID: a6b6a6df7af930050c1c9ecaa713cb2278706dcd97de78112f4413c0d46a13d3
Instruction ID: dc17d01c4b6c24884f69de7581516469b2540acc317e54daeefe38e3f0fed340
Opcode Fuzzy Hash: a6b6a6df7af930050c1c9ecaa713cb2278706dcd97de78112f4413c0d46a13d3
Instruction Fuzzy Hash: 0421F823B0878195E7619BD6B8107AAABDAFB48BE0F484031DE4E63B44DF3CD482C700

Function 00007FFD938E2220 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

tls_construct_stoc_renegotiate, xrefs: 00007FFD93939CAC
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD93939CB8

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_construct_stoc_renegotiate
API String ID: 0-2728901138
Opcode ID: bdcab20151f23b24382d85dfed289776668da40e968fadb33af8566278ae17ab
Instruction ID: ab7548b12f12eecc3b8f42247fdbb705d7eaa8baa68b02a879282245384b3ef2
Opcode Fuzzy Hash: bdcab20151f23b24382d85dfed289776668da40e968fadb33af8566278ae17ab
Instruction Fuzzy Hash: BD215351F1824361FB78A7AAE9257F9539AAF817C4F481030DE0D57AC6DE2EE451C300

Function 00007FFD93931515 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93931594
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939315AC

Strings

ssl_next_proto_validate, xrefs: 00007FFD93931599
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD939315A5

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$ssl_next_proto_validate
API String ID: 193678381-4274311015
Opcode ID: d353fbfe16af1f62cb03c90cdbc643ac01b197627e56d7d95c29f2578f6c9a59
Instruction ID: 7499d316d09e9b719dd9eef1b645e7bab1946969cb49c70693fdc27afeaaa3fc
Opcode Fuzzy Hash: d353fbfe16af1f62cb03c90cdbc643ac01b197627e56d7d95c29f2578f6c9a59
Instruction Fuzzy Hash: 7111A7A2F1968592EB7497A0E8203F96398FF58344F049530EA8D526D6FF2CD6D08700

Function 00007FFD938E2383 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

Strings

tls_construct_stoc_psk, xrefs: 00007FFD93939B72
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD93939B7E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_construct_stoc_psk
API String ID: 0-812599056
Opcode ID: eeccbbb32b76ba9bae1e043c7bc09835041dc0111c37c0e5be4ea264feb94254
Instruction ID: 71eae90f0a512deabf60b56dc71d4412aeed881bdc312138fa2e0f374d15267e
Opcode Fuzzy Hash: eeccbbb32b76ba9bae1e043c7bc09835041dc0111c37c0e5be4ea264feb94254
Instruction Fuzzy Hash: 7F118252B1C10391FB78A7A6F9657B92359AF84BC4F480031EE1D6B6C7DE6DE881C700

Function 00007FFD938E17C1 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

Strings

tls_construct_ctos_maxfragmentlen, xrefs: 00007FFD93932702
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD9393270E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_maxfragmentlen
API String ID: 0-2022521710
Opcode ID: 7121d7135b88c0a3065736cbe285c967d0b49d4b6b9c83b41b2096a3de0b935f
Instruction ID: 6bf3ee8f45d3b75eb864ca26c73b94abd5e1254c9abaabe19980a3a33c89f765
Opcode Fuzzy Hash: 7121d7135b88c0a3065736cbe285c967d0b49d4b6b9c83b41b2096a3de0b935f
Instruction Fuzzy Hash: 6A119151B1C18261FB78B7A6E9217F95388AF847C8F480031ED5E5B6D7DE6EE9908700

Function 00007FFD938E2284 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939327EB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93932803

Strings

tls_construct_ctos_npn, xrefs: 00007FFD939327F0
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD939327FC

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_npn
API String ID: 193678381-1466421906
Opcode ID: 8afd534d9299c95660158255d97b204701d378102185c2ea48e831cca1ee68a7
Instruction ID: dc5d98887cac301b3864a666ed3686e8cf0f54dcff956bb89a04b470abf360bd
Opcode Fuzzy Hash: 8afd534d9299c95660158255d97b204701d378102185c2ea48e831cca1ee68a7
Instruction Fuzzy Hash: EE11E751F1954291F7B89799E5697F91398FF847C0F484130D94D576D2EE2CE5C1C700

Function 00007FFD938E131B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93939EA2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93939EBA

Strings

tls_construct_stoc_session_ticket, xrefs: 00007FFD93939EA7
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD93939EB3

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_construct_stoc_session_ticket
API String ID: 193678381-585220546
Opcode ID: eb846ac678087158e2c67ac383ea53e3b93b01c0cb31d0e691917168a44ddfcf
Instruction ID: 6b655826c078245a6f3b4cc460bb148e58cfaa8c9a1f44d75abed9293cfb5aea
Opcode Fuzzy Hash: eb846ac678087158e2c67ac383ea53e3b93b01c0cb31d0e691917168a44ddfcf
Instruction Fuzzy Hash: 62110661F1C10262F778E79AF525BBA6399AF84780F480030DD0E57AD2DE2DD890C700

Function 00007FFD938E244B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

Strings

tls_construct_ctos_ems, xrefs: 00007FFD9393216E
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FFD9393217A

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_ems
API String ID: 0-3344448950
Opcode ID: 7d42cc853efd7ee615ab6343815f0cf12b16cf0252ae072f7107ffdf345cb191
Instruction ID: b5f268eec10d7165e85621a6b6b389f5de62db011f16e6c7c63228af63383b42
Opcode Fuzzy Hash: 7d42cc853efd7ee615ab6343815f0cf12b16cf0252ae072f7107ffdf345cb191
Instruction Fuzzy Hash: CB010461B18142A2F778E3D6F921BFA6388AF847C4F484030EE4D57AD7EE6DD8808700

Function 00007FFD938E1370 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

ossl_statem_server_write_transition, xrefs: 00007FFD939552EC
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD939552F8

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem_srvr.c$ossl_statem_server_write_transition
API String ID: 0-415349073
Opcode ID: 6264c82bce936dc4e222d51c453f8f3279ad91e46b03a388bfdd0a29d8ca076a
Instruction ID: 354ecb7bfee34f8a2b976171a5bf677922f849bc9eace35a2a979d1e2257014d
Opcode Fuzzy Hash: 6264c82bce936dc4e222d51c453f8f3279ad91e46b03a388bfdd0a29d8ca076a
Instruction Fuzzy Hash: 6201C022F09342A2E3B4D7E0D8A57B82359EB85744F984431DD4EA7792CE6DE9C1C740

Function 00007FFD938E2090 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93955880
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93955898

Strings

tls_construct_cert_status_body, xrefs: 00007FFD93955885
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93955891

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$tls_construct_cert_status_body
API String ID: 193678381-3528029177
Opcode ID: 184bcb2692faef8dcb7cacd9a3b53eb889625a245df9c3a114ce7551c4987a05
Instruction ID: ad373f8bb502b61548d9d884d9b67fc62696fcd7021fd37efc897475b6d4f607
Opcode Fuzzy Hash: 184bcb2692faef8dcb7cacd9a3b53eb889625a245df9c3a114ce7551c4987a05
Instruction Fuzzy Hash: 67017125F1824295E774A7E2E961BFD2358AF84BC4F884031EE0E6BBC6DE5DE5818740

Function 00007FFD93952610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD93952F70: ERR_new.LIBCRYPTO-3(?,00007FFD9395299D,?,?,?,?,00000000,?,?,?,00007FFD93956186), ref: 00007FFD93952FFE
Part of subcall function 00007FFD93952F70: ERR_set_debug.LIBCRYPTO-3(?,00007FFD9395299D,?,?,?,?,00000000,?,?,?,00007FFD93956186), ref: 00007FFD93953016

ERR_new.LIBCRYPTO-3 ref: 00007FFD9395266F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93952687

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93952680
construct_stateful_ticket, xrefs: 00007FFD93952674

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$construct_stateful_ticket
API String ID: 193678381-2590191291
Opcode ID: 0f7dafc98d90613b83f017ada08391b04d7974ff0cd474e88b6cb41dc6d26d55
Instruction ID: a742d17f53f5c1de16f3dd088efca98d275ccb6e9527d2efc023228054d9dc2e
Opcode Fuzzy Hash: 0f7dafc98d90613b83f017ada08391b04d7974ff0cd474e88b6cb41dc6d26d55
Instruction Fuzzy Hash: 3A01B121B19743A1E7B4B7E2F9617F91358AF847C0F440032EE0DA7686EE6CE4908700

Function 00007FFD938E13AC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939549EF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93954A07

Strings

ossl_statem_server_process_message, xrefs: 00007FFD939549F4
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD93954A00

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$ossl_statem_server_process_message
API String ID: 193678381-2684089212
Opcode ID: f4a3fc006d1a9dc02869140602423b720948628d9e0aa97709a68bdf5bfa30ae
Instruction ID: a50cac826451d832e6a7dc22b5ae65a4767c2cf03e210eefbeb24de35002ec69
Opcode Fuzzy Hash: f4a3fc006d1a9dc02869140602423b720948628d9e0aa97709a68bdf5bfa30ae
Instruction Fuzzy Hash: 57F0F426B1C241A6E360A7E5E8627B96358AB44784F900532EE4E536E6DE2DD642CB00

Function 00007FFD938E1276 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9395001E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93950036

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FFD9395002F
tls_construct_key_update, xrefs: 00007FFD93950023

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_construct_key_update
API String ID: 193678381-4067644432
Opcode ID: 62b6398d1d177a83efef6f8a310cf5ae1e3ff013ebdd44d13bb9d40ff3be7047
Instruction ID: 434e37b54ea10ce5dcc2031fa60c5c6e912c102adfca6006db455cd2d8265ccf
Opcode Fuzzy Hash: 62b6398d1d177a83efef6f8a310cf5ae1e3ff013ebdd44d13bb9d40ff3be7047
Instruction Fuzzy Hash: 33F0BEA5F1924362FBB4BBE5D829BF823489F85794F444132ED0D677D2EF2DA5818B00

Function 00007FFD938E2563 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9394033D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93940355

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD9394034E
ossl_statem_client_construct_message, xrefs: 00007FFD93940342

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$ossl_statem_client_construct_message
API String ID: 193678381-1769619531
Opcode ID: 13bc08e60732ebf9c5fbe26a6217c2373a936ece81e218a71fcb6cb508fc0a82
Instruction ID: 7473821c758a0f16b3fca5b839ad8eb9791fc213f34a29b2ed452ec101925ebd
Opcode Fuzzy Hash: 13bc08e60732ebf9c5fbe26a6217c2373a936ece81e218a71fcb6cb508fc0a82
Instruction Fuzzy Hash: 3AF0B462F18542A7E370A3E4E8A57F96758AF89714F508531E90EA33D2EE2DE242C700

Function 00007FFD93925330 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9392534B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93925363

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FFD9392535C
dtls1_write_bytes, xrefs: 00007FFD93925350

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\record\rec_layer_d1.c$dtls1_write_bytes
API String ID: 193678381-1372159586
Opcode ID: 92c8e341b9835d8f9078a0bd727e5bf1ccbcaea479ad0cb269e9fc6b3632c01d
Instruction ID: d11c1a64f7f1d308f07e8e28bab9ff6e9cecceed15d1f5643fc93544fe1b84ab
Opcode Fuzzy Hash: 92c8e341b9835d8f9078a0bd727e5bf1ccbcaea479ad0cb269e9fc6b3632c01d
Instruction Fuzzy Hash: 4BF090A2F1860196E774B7E4E8217E96358AF88364F540131EA4C167D2DF7DD690CB50

Function 00007FFD938E1172 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9393B849
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9393B861

Strings

tls_parse_ctos_ems, xrefs: 00007FFD9393B84E
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FFD9393B85A

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_ems
API String ID: 193678381-2230499117
Opcode ID: 53df696fefbac6b795cc0ce54585cb5dfe01f3e0f5d899642b7c799f82f128c5
Instruction ID: 008f7e0e973e47371b16db7af21af3dabc8474b40fa3c8ddc810b91ed7186d39
Opcode Fuzzy Hash: 53df696fefbac6b795cc0ce54585cb5dfe01f3e0f5d899642b7c799f82f128c5
Instruction Fuzzy Hash: C6F0B4A2F0928262F778E7E0D4697E92398DF40344F540030D90EA26D3DF6D69D5C700

Function 00007FFD938E155F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD93945312
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD9394532A

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93945323
tls_construct_end_of_early_data, xrefs: 00007FFD93945317

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_construct_end_of_early_data
API String ID: 193678381-2034458699
Opcode ID: 0948556e184ac68a7c19737e2948511d81886ddc747b700e31176f15218405f2
Instruction ID: ff5eb04c9310c1198f5c1d98cb551fc7edc2a6710779b2540d4582f8ba0159ac
Opcode Fuzzy Hash: 0948556e184ac68a7c19737e2948511d81886ddc747b700e31176f15218405f2
Instruction Fuzzy Hash: C4F0AE62F1514392F774A7F4D829BE827849F44714F944131DD0DA77D1DE7DA592CB00

Function 00007FFD9394105E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD9394105E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD93941077

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FFD93941070
tls_process_hello_req, xrefs: 00007FFD93941064

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_hello_req
API String ID: 193678381-485657334
Opcode ID: 380d9c9547a1b6624ac42043f6c6b0196d63454a39df10088a9d51e2176a6543
Instruction ID: 3093859e21013c23a46d783559769da941a9093bfb38edf6d7bf1e0529cf544e
Opcode Fuzzy Hash: 380d9c9547a1b6624ac42043f6c6b0196d63454a39df10088a9d51e2176a6543
Instruction Fuzzy Hash: E8E08075F1824691E750DBD6F4115EA6355EFD0740F440032D90D33796DE7CE5558B00

Function 00007FFD939546BD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FFD939546BD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FFD939546D5

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FFD939546CE
tls_process_end_of_early_data, xrefs: 00007FFD939546C2

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_end_of_early_data
API String ID: 193678381-3379596787
Opcode ID: 7d853f27051ef305d6b60adcc0142e93ddeba444e40fe5a1c1a594763ef537fa
Instruction ID: 7816cc351697c7f1bb900bc716f41ac61ca909bfe6d13cb9ff61b759643617d8
Opcode Fuzzy Hash: 7d853f27051ef305d6b60adcc0142e93ddeba444e40fe5a1c1a594763ef537fa
Instruction Fuzzy Hash: 69E0CD35B1814267E760E7E5F4215E96319BFD0340F840032D90D635D39EBCE581CB00

Function 00007FFD938E2257 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

X509_LOOKUP_store.LIBCRYPTO-3 ref: 00007FFD938FE176
X509_STORE_add_lookup.LIBCRYPTO-3 ref: 00007FFD938FE182
ERR_set_mark.LIBCRYPTO-3 ref: 00007FFD938FE19A
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFD938FE1CE

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: X509_$E_add_lookupP_storeR_pop_to_markR_set_mark
String ID:
API String ID: 3476065580-0
Opcode ID: cb09f1179bec7edb40e2e8d828763ab570d824e08acafdaa8ea17abc4de8bd5e
Instruction ID: b2454a435ccac7ed0a3a54d9da5cdf8f7816b169543ceeaad64cacd7e1e503d5
Opcode Fuzzy Hash: cb09f1179bec7edb40e2e8d828763ab570d824e08acafdaa8ea17abc4de8bd5e
Instruction Fuzzy Hash: 80F06266B0974241E760ABD5F4617ADA364EB48BD4F445131EE4C17B8AEE3CD5804B00

Function 00007FFD938FE080 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

X509_STORE_add_lookup.LIBCRYPTO-3 ref: 00007FFD938FE0A2
ERR_set_mark.LIBCRYPTO-3 ref: 00007FFD938FE0BA
X509_LOOKUP_ctrl_ex.LIBCRYPTO-3 ref: 00007FFD938FE0EC
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFD938FE0F1

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: X509_$E_add_lookupP_ctrl_exR_pop_to_markR_set_mark
String ID:
API String ID: 3663983608-0
Opcode ID: 4e8de6fcb889ed67621b90c95a16faa81c60c72036cf917293118e90248bb0b4
Instruction ID: 677405d48f8fae9293287ceda41d6472e3b4cb7df459271df222e57b96ce132c
Opcode Fuzzy Hash: 4e8de6fcb889ed67621b90c95a16faa81c60c72036cf917293118e90248bb0b4
Instruction Fuzzy Hash: 62F0816AB0974241EB60ABD5F0617AD6368EB88BD4F044130EE4C17B8AEF3CD5804F00

Function 00007FFD938F9210 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

OPENSSL_sk_dup.LIBCRYPTO-3(00000000,00007FFD938F8573), ref: 00007FFD938F9229
OPENSSL_sk_free.LIBCRYPTO-3(00000000,00007FFD938F8573), ref: 00007FFD938F9244
OPENSSL_sk_set_cmp_func.LIBCRYPTO-3(00000000,00007FFD938F8573), ref: 00007FFD938F9256
OPENSSL_sk_sort.LIBCRYPTO-3(00000000,00007FFD938F8573), ref: 00007FFD938F925E

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: L_sk_dupL_sk_freeL_sk_set_cmp_funcL_sk_sort
String ID:
API String ID: 1312970346-0
Opcode ID: 12e6d4d1afd1d1277fa0f79b28d99069ba464e4763cb726048a7bb04a3b838b0
Instruction ID: 48c57e51460d6f75fcf9d897f876683df0de3bab9aba79b359af0602667e8ba5
Opcode Fuzzy Hash: 12e6d4d1afd1d1277fa0f79b28d99069ba464e4763cb726048a7bb04a3b838b0
Instruction Fuzzy Hash: E3F08266B0C70191EB65ABEAF5A13B863989F98BC0F445031FE0D57797ED2CD4918700

Function 00007FFD939075B0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD938E2063: ENGINE_finish.LIBCRYPTO-3 ref: 00007FFD93921672

ERR_set_mark.LIBCRYPTO-3 ref: 00007FFD939075DC
OBJ_nid2sn.LIBCRYPTO-3 ref: 00007FFD939075E3
EVP_MD_fetch.LIBCRYPTO-3 ref: 00007FFD939075F1
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FFD939075F9

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: D_fetchE_finishJ_nid2snR_pop_to_markR_set_mark
String ID:
API String ID: 1050435054-0
Opcode ID: 7127929cde7b4689b6cc282457a4f0a2dc6caeda5a604b8849c4ed66afc48e3b
Instruction ID: 3d38008bb8368e307f37e4890c62908464305e3c0616faa67b5a527300ca7939
Opcode Fuzzy Hash: 7127929cde7b4689b6cc282457a4f0a2dc6caeda5a604b8849c4ed66afc48e3b
Instruction Fuzzy Hash: 6EF0EC04F0E38211FA647BD6A45127D52595F88BC0F085034FD4D77BCBDD2CE5414B00

Function 00007FFD93907220 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_free.LIBCRYPTO-3 ref: 00007FFD93907244
EVP_CIPHER_CTX_free.LIBCRYPTO-3 ref: 00007FFD9390725C
COMP_CTX_free.LIBCRYPTO-3 ref: 00007FFD9390726F
COMP_CTX_free.LIBCRYPTO-3 ref: 00007FFD93907282

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: X_free
String ID:
API String ID: 2268491255-0
Opcode ID: 363515c756ca6ebd85c3aec3c2b185af4ebda8eba70b28f4b052b87baa8bd7c7
Instruction ID: bf6fa293b438ca5ff7e948adefbcda3a0ebbcb0b02709b11a53fb57ba1814220
Opcode Fuzzy Hash: 363515c756ca6ebd85c3aec3c2b185af4ebda8eba70b28f4b052b87baa8bd7c7
Instruction Fuzzy Hash: 7BF04F3670968591EB64AFE6D4603B863E8FF90F84F088131EE8C5A69ACE38C0518B50

Function 00007FFD938EE1B2 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FFD938EE1BE
ERR_new.LIBCRYPTO-3 ref: 00007FFD938EE1CF
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FFD938EE1E4
ERR_new.LIBCRYPTO-3 ref: 00007FFD938EE1ED

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: R_new$L_sk_new_nullL_sk_push
String ID:
API String ID: 1838660387-0
Opcode ID: 6bb3114cdefc007a73e5d58c2eb7673d3f1539b19f24d31e1bcdfc093de9257b
Instruction ID: 89d773c06df1c94164a4a3e576cfdba09904062a7baad8f09e24940c3988ffbb
Opcode Fuzzy Hash: 6bb3114cdefc007a73e5d58c2eb7673d3f1539b19f24d31e1bcdfc093de9257b
Instruction Fuzzy Hash: 18E03924F0D70291FA7867E592603BA12888F50785F040030DC8D2AB97EE6EF4C14715

Function 00007FFD938E182A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFD938EFB10
RAND_bytes_ex.LIBCRYPTO-3 ref: 00007FFD938EFB50

Strings

DOWNGRD, xrefs: 00007FFD938EFB8B

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: D_bytes_ex_time64
String ID: DOWNGRD
API String ID: 2101710396-2922851170
Opcode ID: f6d67c190e77e798052bc447661e4371ffaf2059aa6f14a98b87bb3de26420c3
Instruction ID: d3fa3ec4e603add4750f9d3757faf27ce809642bf00810ccdd0479ec84b3d823
Opcode Fuzzy Hash: f6d67c190e77e798052bc447661e4371ffaf2059aa6f14a98b87bb3de26420c3
Instruction Fuzzy Hash: 4D210532B1C68282E7689BAAF56017D6795FBC8784F484035EB4F97745DE2CD8A0C300

Function 00007FFD939416B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

-, xrefs: 00007FFD939416D4

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 18d029d458eabf41ac2aecac09e559e94495be11c20fdf6dead91fd8276cdb86
Instruction ID: 1ffbc3c520485a3d251282b74ca3a061966eb4974ea819a6702a182815805a1c
Opcode Fuzzy Hash: 18d029d458eabf41ac2aecac09e559e94495be11c20fdf6dead91fd8276cdb86
Instruction Fuzzy Hash: 5D116072F0C24196FBA4AF9AE16436D2395EB88B8CF484035DA0D5B386DB3DD895CB00

Function 00007FFD93941677 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFD9394162C
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFD93941639

Strings

', xrefs: 00007FFD93941680

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: '
API String ID: 3946675294-1997036262
Opcode ID: b62216ac9af7fa7a938d27819fd2c62991d406f72beb77c406fed53e70659c17
Instruction ID: 6383b2f219e6e2bdd33db090edcaef8f5baa6821d5bb67ace47f9dcb172243d4
Opcode Fuzzy Hash: b62216ac9af7fa7a938d27819fd2c62991d406f72beb77c406fed53e70659c17
Instruction Fuzzy Hash: FFF09022B0C24196FBA4AFA6E0A437D2395EB88B88F184034DA0D5B7C6DE3CC4C58B00

Function 00007FFD939415BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3 ref: 00007FFD9394162C
BIO_set_flags.LIBCRYPTO-3 ref: 00007FFD93941639

Strings

&, xrefs: 00007FFD939415BF

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: &
API String ID: 3946675294-1010288
Opcode ID: 9af2434b2b51eb0e017bfeb147360ef200104157f31cf2c17b3ec9d3b68af64c
Instruction ID: 19b74a4e20864c224025b57ed664e0895d18395a7d8043d48628e30ccc43d3f4
Opcode Fuzzy Hash: 9af2434b2b51eb0e017bfeb147360ef200104157f31cf2c17b3ec9d3b68af64c
Instruction Fuzzy Hash: FEF09622B0C24146FBA4DFA6E09437D2395EB88B88F084034CA0D5B786DE3CC4818700

Function 00007FFD938E22B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

OSSL_PARAM_construct_octet_string.LIBCRYPTO-3 ref: 00007FFD938EB4D6
OSSL_PARAM_construct_end.LIBCRYPTO-3 ref: 00007FFD938EB4F8

Strings

ssl3-ms, xrefs: 00007FFD938EB4CF

Memory Dump Source

Source File: 00000002.00000002.3402421171.00007FFD938E1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FFD938E0000, based on PE: true

Associated: 00000002.00000002.3402396346.00007FFD938E0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402421171.00007FFD93962000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402499141.00007FFD93964000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402529671.00007FFD9398C000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93991000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD93997000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3402551633.00007FFD9399F000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd938e0000_7EznMik8Fw.jbxd

Similarity

API ID: M_construct_endM_construct_octet_string
String ID: ssl3-ms
API String ID: 587842064-1523337083
Opcode ID: f3b81e7553a3722f27a452938bcffddc8b5c379a9d9b03b29831c97483a52a15
Instruction ID: b7cdcbe3b8a0d60e08ab33d84afbbfb15350d88812a1118464699e7923d395c6
Opcode Fuzzy Hash: f3b81e7553a3722f27a452938bcffddc8b5c379a9d9b03b29831c97483a52a15
Instruction Fuzzy Hash: 80012C53D08F8982E722DFB8C5111B86374FBA9B4CF55A321EA8C26117EF28E2D5C700

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7EznMik8Fw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_ARC4.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_Salsa20.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_chacha20.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_pkcs1_decode.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_aes.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_aesni.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_arc2.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_blowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cast.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cbc.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_cfb.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ctr.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_des.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_des3.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ecb.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_eksblowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ocb.pyd

C:\Users\user\AppData\Local\Temp\_MEI43442\Crypto\Cipher\_raw_ofb.pyd

Windows Analysis Report
7EznMik8Fw.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre