Edit tour

Windows Analysis Report
0jNz7djbpp.exe

Overview

General Information

Sample name:	0jNz7djbpp.exe renamed because original name is a hash value
Original sample name:	151e75f3ed3003b63ecbee13741e788b519db99c5253f32a041f501f28688111.exe
Analysis ID:	1571345
MD5:	2bfda47c91a80443539fb763dc2b6027
SHA1:	4ab34c3028dea6c636ed7ae2f94ec55cd8a78d55
SHA256:	151e75f3ed3003b63ecbee13741e788b519db99c5253f32a041f501f28688111
Tags:	busquedasxurl-comexeuser-JAMESWT_MHT
Infos:

Detection

Python Stealer

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found pyInstaller with non standard icon

Yara detected Generic Python Stealer

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

0jNz7djbpp.exe (PID: 2352 cmdline: "C:\Users\user\Desktop\0jNz7djbpp.exe" MD5: 2BFDA47C91A80443539FB763DC2B6027)

0jNz7djbpp.exe (PID: 3128 cmdline: "C:\Users\user\Desktop\0jNz7djbpp.exe" MD5: 2BFDA47C91A80443539FB763DC2B6027)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: 0jNz7djbpp.exe PID: 3128	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 0jNz7djbpp.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 0jNz7djbpp.exe

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 92.4% probability

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B2365 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81B2365
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A821A930 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FF8A821A930
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B17F8 EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key_ex,EVP_DigestSignInit_ex,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B17F8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1A05 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,	2_2_00007FF8A81B1A05
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1811 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FF8A81B1811
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81CE948 CRYPTO_free,	2_2_00007FF8A81CE948
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C4980 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_snprintf,	2_2_00007FF8A81C4980
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C6990 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_fetch,EVP_CIPHER_get_flags,	2_2_00007FF8A81C6990
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1A32 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1A32
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B117C _time64,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FF8A81B117C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B20E0 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B20E0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B110E EVP_PKEY_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,	2_2_00007FF8A81B110E
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F8A90 CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FF8A81F8A90
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B213F EVP_CIPHER_get_mode,EVP_CIPHER_get_mode,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FF8A81B213F
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B4B10 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81B4B10
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81CCB40 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81CCB40
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81DEB40 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,ERR_new,ERR_set_debug,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,memcpy,	2_2_00007FF8A81DEB40
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B2464 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B2464
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B4BD0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81B4BD0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1F87 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1F87
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81E4C28 EVP_MAC_CTX_free,CRYPTO_free,	2_2_00007FF8A81E4C28
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81CEC00 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	2_2_00007FF8A81CEC00
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F2C10 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FF8A81F2C10
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B11A9 EVP_MAC_CTX_free,CRYPTO_free,	2_2_00007FF8A81B11A9
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8206C40 CRYPTO_realloc,	2_2_00007FF8A8206C40
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B2112 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	2_2_00007FF8A81B2112
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A821ACD0 CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A821ACD0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8210D30 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A8210D30
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81DCD30 CRYPTO_THREAD_write_lock,OPENSSL_sk_new_null,OPENSSL_LH_delete,OPENSSL_sk_push,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,OPENSSL_sk_pop_free,	2_2_00007FF8A81DCD30
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B21E4 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	2_2_00007FF8A81B21E4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D8D10 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8A81D8D10
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1A23 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FF8A81B1A23
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81E8D90 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81E8D90
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81BCDC0 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	2_2_00007FF8A81BCDC0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1E65 ERR_new,ERR_set_debug,CRYPTO_clear_free,	2_2_00007FF8A81B1E65
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B195B CRYPTO_zalloc,EVP_MAC_free,EVP_MAC_CTX_free,CRYPTO_free,	2_2_00007FF8A81B195B
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8206E70 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8206E70
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B105F ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FF8A81B105F
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8200E50 CRYPTO_memcmp,	2_2_00007FF8A8200E50
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1677 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FF8A81B1677
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B2374 CRYPTO_free,	2_2_00007FF8A81B2374
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8212F60 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	2_2_00007FF8A8212F60
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B4FA0 CRYPTO_free,	2_2_00007FF8A81B4FA0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1393 OSSL_PROVIDER_do_all,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	2_2_00007FF8A81B1393
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1B90 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FF8A81B1B90
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81BF060 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A81BF060
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B2121 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B2121
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1262 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FF8A81B1262
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81DD0C0 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	2_2_00007FF8A81DD0C0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A82010C0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A82010C0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A821B0D0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A821B0D0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1140 CRYPTO_free,	2_2_00007FF8A81B1140
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8214110 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FF8A8214110
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C21F0 CRYPTO_THREAD_run_once,	2_2_00007FF8A81C21F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D21C0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	2_2_00007FF8A81D21C0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81CE227 CRYPTO_THREAD_write_lock,	2_2_00007FF8A81CE227
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1389 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81B1389
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F4230 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FF8A81F4230
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F2230 ERR_new,ERR_set_debug,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free,	2_2_00007FF8A81F2230
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81FE200 CRYPTO_free,	2_2_00007FF8A81FE200
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81FE260 CRYPTO_free,	2_2_00007FF8A81FE260
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1401 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81B1401
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B198D CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8A81B198D
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1B54 memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,memcpy,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FF8A81B1B54
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A82222F0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A82222F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B2180 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FF8A81B2180
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A822A2C0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,	2_2_00007FF8A822A2C0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B23D8 EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FF8A81B23D8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B4300 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81B4300
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8208350 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A8208350
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C43A0 OPENSSL_sk_num,X509_STORE_CTX_new_ex,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_new,ERR_set_debug,ERR_set_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	2_2_00007FF8A81C43A0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B25EF CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_clear_free,	2_2_00007FF8A81B25EF
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D0380 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8A81D0380
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B139D memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	2_2_00007FF8A81B139D
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1A0F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,CRYPTO_memcmp,ERR_set_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_pop_to_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,strncmp,strncmp,strncmp,strncmp,strncmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1A0F
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B18B6 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81B18B6
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B84B0 CRYPTO_zalloc,CRYPTO_free,	2_2_00007FF8A81B84B0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1F23 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A81B1F23
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1492 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81B1492
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8222510 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A8222510
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1488 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81B1488
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81FE540 CRYPTO_free,	2_2_00007FF8A81FE540
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8214540 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A8214540
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81FE5A0 CRYPTO_free,	2_2_00007FF8A81FE5A0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81DE5E0 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FF8A81DE5E0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F25D0 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,	2_2_00007FF8A81F25D0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F8620 CRYPTO_free,	2_2_00007FF8A81F8620
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1212 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FF8A81B1212
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B114F CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FF8A81B114F
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81CA600 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FF8A81CA600
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B120D EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,	2_2_00007FF8A81B120D
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B241E CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81B241E
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A82166E0 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FF8A82166E0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A82226E0 CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_fetch,EVP_CIPHER_get_iv_length,RAND_bytes_ex,EVP_CIPHER_free,EVP_EncryptUpdate,EVP_EncryptFinal,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get_iv_length,ERR_new,ERR_new,CRYPTO_free,EVP_CIPHER_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_CIPHER_CTX_free,	2_2_00007FF8A82226E0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B26AD ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A81B26AD
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F86D0 OPENSSL_cleanse,CRYPTO_free,	2_2_00007FF8A81F86D0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B14CE CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A81B14CE
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B17E9 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A81B17E9
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1CA3 CRYPTO_strdup,CRYPTO_free,	2_2_00007FF8A81B1CA3
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8210700 ERR_new,ERR_set_debug,CRYPTO_clear_free,	2_2_00007FF8A8210700
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A822A770 BN_bin2bn,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A822A770
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D6758 CRYPTO_malloc,ERR_new,ERR_set_debug,CRYPTO_clear_free,OPENSSL_LH_num_items,OPENSSL_LH_num_items,ERR_peek_error,X509_STORE_add_lookup,	2_2_00007FF8A81D6758
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B22D4 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81B22D4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1771 CRYPTO_free,	2_2_00007FF8A81B1771
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C4790 CRYPTO_get_ex_new_index,	2_2_00007FF8A81C4790
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C47F0 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81C47F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B17DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81B17DF
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8224809 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A8224809
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B136B ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B136B
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F8810 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FF8A81F8810
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1181 CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81B1181
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B13DE EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_security_bits,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,EVP_PKEY_get_bn_param,EVP_PKEY_get_bn_param,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,ERR_set_debug,EVP_DigestSign,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_free,BN_free,BN_free,BN_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B13DE
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B2577 ERR_new,ERR_set_debug,CRYPTO_free,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_cleanse,	2_2_00007FF8A81B2577
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1A41 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1A41
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1D84 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A81B1D84
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C7980 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,strncmp,CRYPTO_free,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	2_2_00007FF8A81C7980
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B107D CRYPTO_free,	2_2_00007FF8A81B107D
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D59F0 CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81D59F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B204A CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A81B204A
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B271B CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A81B271B
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C5A10 OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	2_2_00007FF8A81C5A10
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1A16 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8A81B1A16
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D6758 CRYPTO_malloc,ERR_new,ERR_set_debug,CRYPTO_clear_free,OPENSSL_LH_num_items,OPENSSL_LH_num_items,ERR_peek_error,X509_STORE_add_lookup,	2_2_00007FF8A81D6758
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8207A40 CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8207A40
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1C53 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FF8A81B1C53
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D6758 CRYPTO_malloc,ERR_new,ERR_set_debug,CRYPTO_clear_free,OPENSSL_LH_num_items,OPENSSL_LH_num_items,ERR_peek_error,X509_STORE_add_lookup,	2_2_00007FF8A81D6758
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D6758 CRYPTO_malloc,ERR_new,ERR_set_debug,CRYPTO_clear_free,OPENSSL_LH_num_items,OPENSSL_LH_num_items,ERR_peek_error,X509_STORE_add_lookup,	2_2_00007FF8A81D6758
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D5AE0 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81D5AE0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81FDAF0 CRYPTO_free,	2_2_00007FF8A81FDAF0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B13D9 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,	2_2_00007FF8A81B13D9
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B23EC CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81B23EC
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C3B30 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FF8A81C3B30
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8215B10 EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FF8A8215B10
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C5B10 COMP_zlib,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	2_2_00007FF8A81C5B10
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81FDB60 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81FDB60
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A821BB70 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A821BB70
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B267B CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8A81B267B
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B23E7 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A81B23E7
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B222A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,	2_2_00007FF8A81B222A
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1361 CRYPTO_malloc,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,ERR_pop_to_mark,CRYPTO_free,EVP_PKEY_free,	2_2_00007FF8A81B1361
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1CEE CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	2_2_00007FF8A81B1CEE
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B150F OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	2_2_00007FF8A81B150F
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B5C53 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	2_2_00007FF8A81B5C53
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D5CF0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,d2i_X509,X509_get0_pubkey,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81D5CF0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1F37 CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1F37
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B19DD BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A81B19DD
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8207CD0 CRYPTO_memcmp,	2_2_00007FF8A8207CD0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8213D30 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FF8A8213D30
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1CBC EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1CBC
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1F50 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8A81B1F50
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B15E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,memcpy,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81B15E6
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C5D80 CRYPTO_THREAD_run_once,	2_2_00007FF8A81C5D80
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1CE9 memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81B1CE9
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D1E60 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	2_2_00007FF8A81D1E60
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B16A4 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B16A4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B3EB0 CRYPTO_free,	2_2_00007FF8A81B3EB0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B5E80 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	2_2_00007FF8A81B5E80
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B24E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A81B24E6
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81BDEC0 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81BDEC0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81CBEC0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A81CBEC0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B236F CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B236F
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8229F10 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A8229F10
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8221F70 CRYPTO_memcmp,	2_2_00007FF8A8221F70
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1EDD CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1EDD
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1AC3 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8A81B1AC3
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B2027 CRYPTO_free,	2_2_00007FF8A81B2027
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81BDFB2 ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,	2_2_00007FF8A81BDFB2
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1D8E EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_MAC_init,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free,	2_2_00007FF8A81B1D8E
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B103C CRYPTO_malloc,COMP_expand_block,	2_2_00007FF8A81B103C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81E4000 CRYPTO_realloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81E4000
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81FE040 CRYPTO_free,	2_2_00007FF8A81FE040
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1893
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A82080A0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A82080A0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1AB4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B24C8 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	2_2_00007FF8A81B24C8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B26DF BIO_s_file,BIO_new,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,strncmp,ERR_new,ERR_set_debug,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	2_2_00007FF8A81B26DF
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81FE0C1 CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81FE0C1
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8211126 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FF8A8211126
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A821D170 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	2_2_00007FF8A821D170
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81BD140 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81BD140
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B111D CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	2_2_00007FF8A81B111D
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B20EF CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81B20EF
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81BB200 CRYPTO_clear_free,	2_2_00007FF8A81BB200
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1483 CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1483
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8213210 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	2_2_00007FF8A8213210
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B155A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FF8A81B155A
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F52A0 CRYPTO_free,	2_2_00007FF8A81F52A0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B230B ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free,	2_2_00007FF8A81B230B
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81BD2E1 CRYPTO_free,	2_2_00007FF8A81BD2E1
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A82012E0 ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8A82012E0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1997 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FF8A81B1997
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81FD2F0 RAND_bytes_ex,CRYPTO_malloc,memset,	2_2_00007FF8A81FD2F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B144C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,	2_2_00007FF8A81B144C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1ED8 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81B1ED8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1992 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new_ex,OPENSSL_sk_num,X509_VERIFY_PARAM_new,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1992
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B11BD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81B11BD
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F9370 ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FF8A81F9370
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81B1ACD
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8213420 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	2_2_00007FF8A8213420
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B193D CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81B193D
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1023 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81B1023
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81E3460 CRYPTO_malloc,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,ERR_set_debug,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81E3460
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81FF490 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81FF490
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C14E0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A81C14E0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B12CB CRYPTO_THREAD_run_once,	2_2_00007FF8A81B12CB
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81BF540 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_derive_set_peer,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,	2_2_00007FF8A81BF540
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8225540 CRYPTO_memcmp,	2_2_00007FF8A8225540
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F35E0 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A81F35E0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A820F660 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A820F660
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1646 EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,EVP_DigestVerify,ERR_new,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	2_2_00007FF8A81B1646
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B2522 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B2522
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B176C CRYPTO_malloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	2_2_00007FF8A81B176C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B25D6 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	2_2_00007FF8A81B25D6
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C7730 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FF8A81C7730
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	2_2_00007FF8A81B1087
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B108C ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FF8A81B108C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8207770 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8207770
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81DD750 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8A81DD750
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C97B0 CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A81C97B0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8229790 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,	2_2_00007FF8A8229790
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1582 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FF8A81B1582
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81BF7F0 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,	2_2_00007FF8A81BF7F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B11DB EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8A81B11DB
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B19E7 CRYPTO_free,	2_2_00007FF8A81B19E7
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B162C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FF8A81B162C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8227820 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_new,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A8227820
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D5870 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8A81D5870
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B586A BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	2_2_00007FF8A81B586A
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1846 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,OPENSSL_sk_num,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1846
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8219850 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A8219850
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A82138A0 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,	2_2_00007FF8A82138A0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8A81B1B31
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A820F8F0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A820F8F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B2590 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FF8A81B2590
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1B18 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_memcmp,ERR_new,ERR_new,	2_2_00007FF8A81B1B18
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78318E0 _Py_NoneStruct,_PyArg_UnpackKeywords,PyObject_GetBuffer,PyBuffer_IsContiguous,PyObject_GetBuffer,PyBuffer_IsContiguous,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,EVP_PBE_scrypt,PyBytes_FromStringAndSize,PyEval_SaveThread,EVP_PBE_scrypt,PyEval_RestoreThread,PyExc_ValueError,PyErr_SetString,PyBuffer_Release,PyBuffer_Release,PyLong_AsLong,PyErr_Occurred,PyLong_AsLong,PyErr_Occurred,PyExc_ValueError,PyExc_ValueError,PyErr_Format,_PyArg_BadArgument,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_OverflowError,PyExc_OverflowError,_Py_Dealloc,PyExc_ValueError,	2_2_00007FF8B78318E0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B7836244 CRYPTO_memcmp,	2_2_00007FF8B7836244
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78A51D4 ASN1_STRING_type,ASN1_STRING_length,ASN1_STRING_get0_data,_Py_BuildValue_SizeT,ASN1_STRING_to_UTF8,_Py_Dealloc,_Py_BuildValue_SizeT,CRYPTO_free,	2_2_00007FF8B78A51D4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78A4F20 i2d_X509,PyBytes_FromStringAndSize,CRYPTO_free,	2_2_00007FF8B78A4F20

Source: 0jNz7djbpp.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060431720.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060764174.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32pdh.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2094058307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, win32pdh.pyd.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058050234.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: ucrtbase.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3307512900.00007FF8A8EF5000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058852349.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2057146485.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059606121.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060288421.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060835092.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: 0jNz7djbpp.exe, 00000002.00000002.3305271995.00007FF8A8629000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb source: win32api.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 0jNz7djbpp.exe, 00000000.00000003.2054452813.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: pywintypes312.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058345809.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059754039.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2054608408.0000016995635000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059465815.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059977079.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: pywintypes312.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3309566919.00007FF8B93D1000.00000002.00000001.01000000.00000008.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3307882428.00007FF8B7837000.00000002.00000001.01000000.00000017.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2057763987.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059081583.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2056926291.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3308274889.00007FF8B7DE8000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2057884647.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059900462.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3308514897.00007FF8B7E52000.00000002.00000001.01000000.0000000D.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3308790009.00007FF8B8B3C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3309413093.00007FF8B8F8D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059234758.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdbUGP source: 0jNz7djbpp.exe, 00000002.00000002.3307512900.00007FF8A8EF5000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3308615266.00007FF8B8B09000.00000002.00000001.01000000.0000000E.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: 0jNz7djbpp.exe, 00000000.00000003.2054608408.0000016995635000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060982878.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3306195847.00007FF8A8B84000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058243770.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3303682517.00007FF8A819F000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: 0jNz7djbpp.exe, 00000002.00000002.3305271995.00007FF8A86C1000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: 0jNz7djbpp.exe, 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059538255.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059009558.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3309185509.00007FF8B8CB6000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2057015645.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059828437.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2054452813.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058767806.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060508345.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3305271995.00007FF8A86C1000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059156566.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3309819998.00007FF8B9843000.00000002.00000001.01000000.0000000F.sdmp, select.pyd.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058940627.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2061053867.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb!! source: win32api.pyd.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059309779.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059678451.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059397415.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058149992.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3308790009.00007FF8B8B3C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060691291.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058669882.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3309322062.00007FF8B8F73000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3310216576.00007FF8BA4F4000.00000002.00000001.01000000.0000000C.sdmp, _wmi.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058433547.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3310216576.00007FF8BA4F4000.00000002.00000001.01000000.0000000C.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299367779.0000014DF3BC0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060362049.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060910371.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3308015574.00007FF8B78AD000.00000002.00000001.01000000.00000012.sdmp, _ssl.pyd.0.dr

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC97E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF73EC97E4C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC888D0 FindFirstFileExW,FindClose,	0_2_00007FF73EC888D0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECA1EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF73ECA1EE4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC97E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF73EC97E4C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8EB304C FindFirstFileExW,FindNextFileW,FindClose,	2_2_00007FF8A8EB304C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8EB3290 FindFirstFileExW,FindNextFileW,FindClose,	2_2_00007FF8A8EB3290

Source: Joe Sandbox View

IP Address: 34.224.200.202 34.224.200.202

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Code function: 2_2_00007FF8B8B06594 memset,recvfrom,

2_2_00007FF8B8B06594

Source: global traffic

DNS traffic detected: DNS query: httpbin.org

Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F2F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3302300225.0000014DF57C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: 0jNz7djbpp.exe, 00000002.00000002.3300788421.0000014DF4A60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/vcpython27
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://arxiv.org/abs/1805.10941.
Source: 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRoot
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068451720.0000016995638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF421C000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2107676215.0000014DF421F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299717589.0000014DF4061000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2106229554.0000014DF4128000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3E72000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2106229554.0000014DF40D9000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2107852422.0000014DF3E9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D43000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D43000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D43000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlU
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crllication
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D43000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.cr
Source: _hashlib.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 0jNz7djbpp.exe, 00000002.00000002.3302190026.0000014DF56C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: 0jNz7djbpp.exe, 00000002.00000002.3302015458.0000014DF54C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: 0jNz7djbpp.exe, 00000002.00000002.3302015458.0000014DF54C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: 0jNz7djbpp.exe, 00000002.00000002.3302015458.0000014DF54C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: 0jNz7djbpp.exe, 00000002.00000002.3300531836.0000014DF4860000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300195894.0000014DF4530000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: 0jNz7djbpp.exe, 00000002.00000003.2110910270.0000014DF428A000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF427C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/unittest.html
Source: 0jNz7djbpp.exe, 00000002.00000002.3300291942.0000014DF4650000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300531836.0000014DF4860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: 0jNz7djbpp.exe, 00000002.00000002.3300291942.0000014DF4650000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300531836.0000014DF4860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: 0jNz7djbpp.exe, 00000002.00000003.2111125616.0000014DF4D71000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300952815.0000014DF4CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3E72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: 0jNz7djbpp.exe, 00000002.00000002.3300952815.0000014DF4CE3000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://mathworld.wolfram.com/BinomialDistribution.html
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://mathworld.wolfram.com/CauchyDistribution.html
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://mathworld.wolfram.com/GammaDistribution.html
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://mathworld.wolfram.com/HypergeometricDistribution.html
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://mathworld.wolfram.com/LaplaceDistribution.html
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://mathworld.wolfram.com/LogisticDistribution.html
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://mathworld.wolfram.com/NegativeBinomialDistribution.html
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://mathworld.wolfram.com/NoncentralF-Distribution.html
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://mathworld.wolfram.com/PoissonDistribution.html
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.esZ
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: 0jNz7djbpp.exe, 00000002.00000002.3300112896.0000014DF4410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: 0jNz7djbpp.exe, 00000000.00000003.2088405485.0000016995639000.00000004.00000020.00020000.00000000.sdmp, _sfc64.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://pracrand.sourceforge.net/RNG_engines.txt
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3298673525.0000014DF1D88000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: 0jNz7djbpp.exe, 00000002.00000002.3298673525.0000014DF1D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: 0jNz7djbpp.exe, 00000002.00000002.3302190026.0000014DF56C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D9D000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl:
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D9D000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: 0jNz7djbpp.exe, 00000002.00000002.3299628168.0000014DF3F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/4)
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2065348950.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2089931774.0000016995639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 0jNz7djbpp.exe, 00000002.00000002.3300058980.0000014DF4368000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: 0jNz7djbpp.exe, 00000002.00000002.3300952815.0000014DF4CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://www.inference.org.uk/mackay/itila/
Source: 0jNz7djbpp.exe, 00000000.00000003.2087623431.0000016995639000.00000004.00000020.00020000.00000000.sdmp, _mt19937.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/JUMP/
Source: 0jNz7djbpp.exe, 00000000.00000003.2087865526.0000016995639000.00000004.00000020.00020000.00000000.sdmp, _pcg64.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://www.pcg-random.org/
Source: bit_generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.html
Source: 0jNz7djbpp.exe, 00000000.00000003.2088405485.0000016995639000.00000004.00000020.00020000.00000000.sdmp, _sfc64.cp312-win_amd64.pyd.0.dr	String found in binary or memory: http://www.pcg-random.org/posts/random-invertible-mapping-statistics.html
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: 0jNz7djbpp.exe, 00000002.00000002.3300952815.0000014DF4CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: 0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 0jNz7djbpp.exe, 00000002.00000003.2111080086.0000014DF438F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111011723.0000014DF4389000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300058980.0000014DF4368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/botz
Source: 0jNz7djbpp.exe, 00000002.00000002.3300291942.0000014DF4650000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: 0jNz7djbpp.exe, 00000002.00000003.2111080086.0000014DF438F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111011723.0000014DF4389000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300058980.0000014DF4368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://busquedasxurl.com/login/conexion/bloqueadoreslogs.php?ip=
Source: 0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://busquedasxurl.com/login/conexion/bloqueadoreslogs.php?ip=y
Source: 0jNz7djbpp.exe, 00000002.00000002.3302461903.0000014DF596C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://busquedasxurl.com/login/conexion/recibidor.php
Source: 0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io
Source: METADATA.0.dr	String found in binary or memory: https://cryptography.io/
Source: 0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: 0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: 0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3E72000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2106294038.0000014DF3EAC000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2107852422.0000014DF3E9B000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2105480166.0000014DF3EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3E72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: 0jNz7djbpp.exe, 00000002.00000002.3302461903.0000014DF596C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/socket.html#socket.socket.connect_ex
Source: 0jNz7djbpp.exe, 00000002.00000002.3302190026.0000014DF56C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: 0jNz7djbpp.exe, 00000002.00000003.2111080086.0000014DF438F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111011723.0000014DF4389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapoz
Source: bit_generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://gist.github.com/imneme/540829265469e673d045
Source: 0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300291942.0000014DF4650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF427C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: 0jNz7djbpp.exe, 00000002.00000002.3299099681.0000014DF3880000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3298673525.0000014DF1E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: 0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300112896.0000014DF4410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: 0jNz7djbpp.exe, 00000000.00000002.3298672667.0000016995646000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093637975.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091233599.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2094058307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093766483.0000016995639000.00000004.00000020.00020000.00000000.sdmp, win32api.pyd.0.dr, pywintypes312.dll.0.dr, win32pdh.pyd.0.dr	String found in binary or memory: https://github.com/mhammond/pywin32
Source: 0jNz7djbpp.exe, 00000002.00000002.3300195894.0000014DF4530000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: 0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography
Source: 0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/
Source: 0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: 0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: 0jNz7djbpp.exe, 00000002.00000002.3300531836.0000014DF4860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: 0jNz7djbpp.exe, 00000002.00000002.3300531836.0000014DF4860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: 0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: 0jNz7djbpp.exe, 00000002.00000002.3298992829.0000014DF37FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: 0jNz7djbpp.exe, 00000002.00000002.3298673525.0000014DF1E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: 0jNz7djbpp.exe, 00000002.00000002.3299099681.0000014DF3880000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3298673525.0000014DF1E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: 0jNz7djbpp.exe, 00000002.00000003.2103942033.0000014DF3E59000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103812799.0000014DF4050000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299099681.0000014DF38D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: 0jNz7djbpp.exe, 00000002.00000002.3300531836.0000014DF4860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/issues/396
Source: 0jNz7djbpp.exe, 00000002.00000002.3300531836.0000014DF4860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/issues/3960
Source: 0jNz7djbpp.exe, 00000002.00000002.3299099681.0000014DF3880000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3298673525.0000014DF1E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: 0jNz7djbpp.exe, 00000002.00000002.3302190026.0000014DF56C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: 0jNz7djbpp.exe, 00000002.00000003.2111080086.0000014DF438F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111011723.0000014DF4389000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300058980.0000014DF4368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: 0jNz7djbpp.exe, 00000002.00000002.3302117477.0000014DF55C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: 0jNz7djbpp.exe, 00000002.00000002.3299099681.0000014DF3880000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2110910270.0000014DF428A000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF427C000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF40E8000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: 0jNz7djbpp.exe, 00000002.00000003.2110910270.0000014DF428A000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF427C000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF40E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: 0jNz7djbpp.exe, 00000002.00000002.3300058980.0000014DF4368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: 0jNz7djbpp.exe, 00000002.00000002.3302300225.0000014DF57C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: 0jNz7djbpp.exe, 00000002.00000002.3302461903.0000014DF59B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip0
Source: 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: 0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: 0jNz7djbpp.exe, 00000002.00000002.3300195894.0000014DF4530000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: 0jNz7djbpp.exe, 00000002.00000002.3302461903.0000014DF59B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/json
Source: 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3D9A000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2110910270.0000014DF428A000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF427C000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: 0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: _sfc64.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://numpy.org/devdocs/user/troubleshooting-importerror.html#c-api-incompatibility
Source: 0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: 0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF421C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
Source: 0jNz7djbpp.exe, 00000002.00000002.3300531836.0000014DF4860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: 0jNz7djbpp.exe, 00000002.00000002.3300291942.0000014DF4650000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: 0jNz7djbpp.exe, 00000002.00000003.2104650574.0000014DF3E39000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300112896.0000014DF4410000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2104160922.0000014DF3E39000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2104160922.0000014DF3D32000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2097764926.0000014DF394F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2098074179.0000014DF394F000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: 0jNz7djbpp.exe, 00000002.00000002.3306195847.00007FF8A8B84000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: 0jNz7djbpp.exe, 00000002.00000002.3300788421.0000014DF4A60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0685/
Source: _multiarray_umath.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_67.htm
Source: _multiarray_umath.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_69.htm
Source: _multiarray_umath.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_79.htm
Source: _multiarray_umath.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_83.htm
Source: _multiarray_umath.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_86.htm
Source: 0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: 0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://pypi.org/project/cryptography/
Source: 0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: 0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300291942.0000014DF4650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: 0jNz7djbpp.exe, 00000002.00000002.3302461903.0000014DF591C000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: 0jNz7djbpp.exe, 00000002.00000002.3302461903.0000014DF591C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.ioxep%
Source: 0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: 0jNz7djbpp.exe, 00000002.00000003.2103375897.0000014DF3973000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103172660.0000014DF3E84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: 0jNz7djbpp.exe, 00000002.00000003.2103568266.0000014DF3E84000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103172660.0000014DF3E84000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299099681.0000014DF38D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: 0jNz7djbpp.exe, 00000002.00000002.3300112896.0000014DF4410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: 0jNz7djbpp.exe, 00000002.00000003.2103519400.0000014DF3EAC000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103172660.0000014DF3E84000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103055909.0000014DF4011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr#
Source: 0jNz7djbpp.exe, 00000002.00000003.2103519400.0000014DF3EAC000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103172660.0000014DF3E84000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103055909.0000014DF4011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr#r$Nrjr
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://stat.ethz.ch/~stahel/lognormal/bioscience.pdf
Source: 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111080086.0000014DF438F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3D9A000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111011723.0000014DF4389000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300058980.0000014DF4368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: 0jNz7djbpp.exe, 00000002.00000002.3299099681.0000014DF3880000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3D48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: 0jNz7djbpp.exe, 00000002.00000002.3300531836.0000014DF4860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://upload.pypi.org/legacy/
Source: 0jNz7djbpp.exe, 00000002.00000002.3302190026.0000014DF56C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: 0jNz7djbpp.exe, 00000002.00000002.3302190026.0000014DF56C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: 0jNz7djbpp.exe, 00000002.00000003.2111125616.0000014DF4D71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://web.archive.org/web/20090423014010/http://www.brighton-webs.co.uk:80/distributions/wald.asp
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://web.archive.org/web/20090514091424/http://brighton-webs.co.uk:80/distributions/rayleigh.asp
Source: 0jNz7djbpp.exe, 00000002.00000003.2106229554.0000014DF4128000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2106229554.0000014DF40D9000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2107676215.0000014DF4128000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: 0jNz7djbpp.exe, 00000000.00000003.2062112050.000001699563B000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: 0jNz7djbpp.exe, 00000000.00000003.2062112050.000001699563B000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2062200984.0000016995646000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2062112050.0000016995646000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: 0jNz7djbpp.exe, 00000000.00000003.2087865526.0000016995639000.00000004.00000020.00020000.00000000.sdmp, _pcg64.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://www.cs.hmc.edu/tr/hmc-cs-2014-0905.pdf
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://www.itl.nist.gov/div898/handbook/eda/section3/eda3663.htm
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://www.itl.nist.gov/div898/handbook/eda/section3/eda3666.htm
Source: _generator.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://www.itl.nist.gov/div898/software/dataplot/refman2/auxillar/powpdf.pdf
Source: 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3305794910.00007FF8A876A000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: 0jNz7djbpp.exe, 00000002.00000002.3298992829.0000014DF3780000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: 0jNz7djbpp.exe, 00000002.00000002.3306793258.00007FF8A8CFC000.00000008.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: 0jNz7djbpp.exe, 00000002.00000002.3306195847.00007FF8A8B84000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: 0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: 0jNz7djbpp.exe, 00000002.00000003.2110910270.0000014DF428A000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF427C000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF40E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECA6370	0_2_00007FF73ECA6370
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC87950	0_2_00007FF73EC87950
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECA72BC	0_2_00007FF73ECA72BC
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECA9FF8	0_2_00007FF73ECA9FF8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC88FD0	0_2_00007FF73EC88FD0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC97E4C	0_2_00007FF73EC97E4C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC95F30	0_2_00007FF73EC95F30
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECA471C	0_2_00007FF73ECA471C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC81F50	0_2_00007FF73EC81F50
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECA0F38	0_2_00007FF73ECA0F38
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC920A0	0_2_00007FF73EC920A0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC91880	0_2_00007FF73EC91880
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC9E01C	0_2_00007FF73EC9E01C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECA65EC	0_2_00007FF73ECA65EC
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECA6D70	0_2_00007FF73ECA6D70
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC92D50	0_2_00007FF73EC92D50
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC936E0	0_2_00007FF73EC936E0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECA1EE4	0_2_00007FF73ECA1EE4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC986D0	0_2_00007FF73EC986D0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC91E94	0_2_00007FF73EC91E94
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC97E4C	0_2_00007FF73EC97E4C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC9EB30	0_2_00007FF73EC9EB30
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC9E4B0	0_2_00007FF73EC9E4B0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC97C98	0_2_00007FF73EC97C98
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC91C90	0_2_00007FF73EC91C90
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC9A430	0_2_00007FF73EC9A430
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC93AE4	0_2_00007FF73EC93AE4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC922A4	0_2_00007FF73EC922A4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECA0F38	0_2_00007FF73ECA0F38
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECA4280	0_2_00007FF73ECA4280
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC91A84	0_2_00007FF73EC91A84
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A80918A0	2_2_00007FF8A80918A0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A80912F0	2_2_00007FF8A80912F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F5770	2_2_00007FF8A81F5770
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B17F8	2_2_00007FF8A81B17F8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1618	2_2_00007FF8A81B1618
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B26FD	2_2_00007FF8A81B26FD
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B2612	2_2_00007FF8A81B2612
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B117C	2_2_00007FF8A81B117C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B24D7	2_2_00007FF8A81B24D7
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B149C	2_2_00007FF8A81B149C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B21C1	2_2_00007FF8A81B21C1
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1C12	2_2_00007FF8A81B1C12
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81C70B0	2_2_00007FF8A81C70B0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B116D	2_2_00007FF8A81B116D
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1B54	2_2_00007FF8A81B1B54
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81E83F0	2_2_00007FF8A81E83F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1A0F	2_2_00007FF8A81B1A0F
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A821C530	2_2_00007FF8A821C530
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B16FE	2_2_00007FF8A81B16FE
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B8630	2_2_00007FF8A81B8630
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A82226E0	2_2_00007FF8A82226E0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B143D	2_2_00007FF8A81B143D
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B13DE	2_2_00007FF8A81B13DE
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1596	2_2_00007FF8A81B1596
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B21DF	2_2_00007FF8A81B21DF
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8229B30	2_2_00007FF8A8229B30
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1AD7	2_2_00007FF8A81B1AD7
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D5CF0	2_2_00007FF8A81D5CF0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1CBC	2_2_00007FF8A81B1CBC
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1EDD	2_2_00007FF8A81B1EDD
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1D8E	2_2_00007FF8A81B1D8E
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B155A	2_2_00007FF8A81B155A
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81FD2F0	2_2_00007FF8A81FD2F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81F9370	2_2_00007FF8A81F9370
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1FD7	2_2_00007FF8A81B1FD7
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81DB700	2_2_00007FF8A81DB700
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81FD7C0	2_2_00007FF8A81FD7C0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B1546	2_2_00007FF8A81B1546
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E4C950	2_2_00007FF8A8E4C950
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E5CAC0	2_2_00007FF8A8E5CAC0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8EB2A78	2_2_00007FF8A8EB2A78
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E65A40	2_2_00007FF8A8E65A40
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E6BB9C	2_2_00007FF8A8E6BB9C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E60B10	2_2_00007FF8A8E60B10
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E61C94	2_2_00007FF8A8E61C94
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E4BC80	2_2_00007FF8A8E4BC80
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8EB2C58	2_2_00007FF8A8EB2C58
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E47C30	2_2_00007FF8A8E47C30
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8EA7C2C	2_2_00007FF8A8EA7C2C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E4FC20	2_2_00007FF8A8E4FC20
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E45DB4	2_2_00007FF8A8E45DB4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E81EB0	2_2_00007FF8A8E81EB0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8EE5E74	2_2_00007FF8A8EE5E74
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E4EE40	2_2_00007FF8A8E4EE40
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8EE8E08	2_2_00007FF8A8EE8E08
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E50FF0	2_2_00007FF8A8E50FF0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E42FA0	2_2_00007FF8A8E42FA0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E5EF44	2_2_00007FF8A8E5EF44
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8ED00CC	2_2_00007FF8A8ED00CC
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E521D0	2_2_00007FF8A8E521D0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E48174	2_2_00007FF8A8E48174
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E43274	2_2_00007FF8A8E43274
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E4233C	2_2_00007FF8A8E4233C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E5D460	2_2_00007FF8A8E5D460
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E4F500	2_2_00007FF8A8E4F500
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E6E770	2_2_00007FF8A8E6E770
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E426F8	2_2_00007FF8A8E426F8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E4F880	2_2_00007FF8A8E4F880
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B780C480	2_2_00007FF8B780C480
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B7810980	2_2_00007FF8B7810980
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78312B0	2_2_00007FF8B78312B0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78318E0	2_2_00007FF8B78318E0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B7831000	2_2_00007FF8B7831000
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78A8CAC	2_2_00007FF8B78A8CAC
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78A5AB4	2_2_00007FF8B78A5AB4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78ABAE8	2_2_00007FF8B78ABAE8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78A52E0	2_2_00007FF8B78A52E0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78A85A8	2_2_00007FF8B78A85A8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78A99C0	2_2_00007FF8B78A99C0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78A9DBC	2_2_00007FF8B78A9DBC
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B7E37BA0	2_2_00007FF8B7E37BA0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B7E37F79	2_2_00007FF8B7E37F79
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B01220	2_2_00007FF8B8B01220
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B03AD0	2_2_00007FF8B8B03AD0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B22520	2_2_00007FF8B8B22520
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B212B0	2_2_00007FF8B8B212B0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B26E50	2_2_00007FF8B8B26E50
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B22FD0	2_2_00007FF8B8B22FD0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B21BA0	2_2_00007FF8B8B21BA0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B25360	2_2_00007FF8B8B25360
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B2F8BC	2_2_00007FF8B8B2F8BC
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B28CD0	2_2_00007FF8B8B28CD0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B25C90	2_2_00007FF8B8B25C90
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8F82F00	2_2_00007FF8B8F82F00
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8F86100	2_2_00007FF8B8F86100
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8F81000	2_2_00007FF8B8F81000
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8F83F10	2_2_00007FF8B8F83F10
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8F83C80	2_2_00007FF8B8F83C80
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8F8C8BC	2_2_00007FF8B8F8C8BC
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B93C3280	2_2_00007FF8B93C3280
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B93C531C	2_2_00007FF8B93C531C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B9F67CA0	2_2_00007FF8B9F67CA0

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: String function: 00007FF8B7803880 appears 114 times
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: String function: 00007FF8A822C265 appears 48 times
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: String function: 00007FF8A822C17B appears 38 times
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: String function: 00007FF8A822C181 appears 1192 times
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: String function: 00007FF8A822C16F appears 335 times
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: String function: 00007FF8A81B1325 appears 478 times
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: String function: 00007FF8B7803800 appears 51 times
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: String function: 00007FF8A822C931 appears 39 times
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: String function: 00007FF8A822C93D appears 69 times
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: String function: 00007FF73EC82B30 appears 47 times

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.dr

Static PE information: Number of sections : 19 > 10

Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: python3.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found

Source: 0jNz7djbpp.exe, 00000000.00000003.2059828437.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059606121.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2060691291.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2060593948.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2060288421.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059009558.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2056926291.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2058852349.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2060764174.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2068680599.0000016995638000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2058243770.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059754039.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2057763987.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000002.3298672667.0000016995646000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32pdh.pyd0 vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2057146485.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059538255.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2060982878.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2057015645.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2093637975.0000016995639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059081583.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2057884647.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2091233599.0000016995639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes312.dll0 vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059309779.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2058767806.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059465815.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2055141102.0000016995635000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2058050234.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2055310924.0000016995636000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2061053867.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2060910371.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2058940627.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2060835092.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2094058307.0000016995639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32pdh.pyd0 vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2056077450.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059900462.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059678451.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2058345809.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2093766483.0000016995639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32crypt.pyd0 vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059977079.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2060508345.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059397415.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2092500817.0000016995639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2058669882.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2091693863.0000016995639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2089115661.0000016995639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059234758.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2054452813.0000016995635000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2058433547.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2054608408.0000016995635000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2056217226.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2060431720.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2059156566.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2058149992.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000000.00000003.2060362049.0000016995637000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe	Binary or memory string: OriginalFilename vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3308176623.00007FF8B78C9000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3304042650.00007FF8A81A4000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3308943042.00007FF8B8B45000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilenamelibsslH vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3309644148.00007FF8B93DE000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3307326956.00007FF8A8E25000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3309469304.00007FF8B8F92000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3310282248.00007FF8BA4F7000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3309359337.00007FF8B8F76000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3308694750.00007FF8B8B13000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3309222046.00007FF8B8CBB000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3305794910.00007FF8A876A000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3307604562.00007FF8A8F32000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3309903488.00007FF8B9846000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3308355103.00007FF8B7DEF000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3307918512.00007FF8B783E000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3308554209.00007FF8B7E5D000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs 0jNz7djbpp.exe
Source: 0jNz7djbpp.exe, 00000002.00000002.3299367779.0000014DF3BC0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs 0jNz7djbpp.exe

Source: classification engine

Classification label: mal76.troj.winEXE@3/102@1/1

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Code function: 0_2_00007FF73EC88560 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF73EC88560

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI23522

Jump to behavior

Source: 0jNz7djbpp.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0jNz7djbpp.exe

ReversingLabs: Detection: 15%

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

File read: C:\Users\user\Desktop\0jNz7djbpp.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\0jNz7djbpp.exe "C:\Users\user\Desktop\0jNz7djbpp.exe"
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Process created: C:\Users\user\Desktop\0jNz7djbpp.exe "C:\Users\user\Desktop\0jNz7djbpp.exe"
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Process created: C:\Users\user\Desktop\0jNz7djbpp.exe "C:\Users\user\Desktop\0jNz7djbpp.exe"	Jump to behavior

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: 0jNz7djbpp.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 0jNz7djbpp.exe

Static file information: File size 31979318 > 1048576

Source: 0jNz7djbpp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 0jNz7djbpp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 0jNz7djbpp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 0jNz7djbpp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 0jNz7djbpp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 0jNz7djbpp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 0jNz7djbpp.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 0jNz7djbpp.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060431720.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060764174.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32pdh.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2094058307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, win32pdh.pyd.0.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058050234.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: ucrtbase.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3307512900.00007FF8A8EF5000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058852349.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2057146485.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059606121.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060288421.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060835092.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: 0jNz7djbpp.exe, 00000002.00000002.3305271995.00007FF8A8629000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb source: win32api.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: 0jNz7djbpp.exe, 00000000.00000003.2054452813.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb** source: pywintypes312.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2055712432.0000016995637000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058345809.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059754039.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2054608408.0000016995635000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059465815.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059977079.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\pywintypes.pdb source: pywintypes312.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3309566919.00007FF8B93D1000.00000002.00000001.01000000.00000008.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2055478715.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3307882428.00007FF8B7837000.00000002.00000001.01000000.00000017.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2057763987.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059081583.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2056926291.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2054723185.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3308274889.00007FF8B7DE8000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2057884647.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059900462.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3308514897.00007FF8B7E52000.00000002.00000001.01000000.0000000D.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3308790009.00007FF8B8B3C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2054842744.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3309413093.00007FF8B8F8D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059234758.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source:	Binary string: ucrtbase.pdbUGP source: 0jNz7djbpp.exe, 00000002.00000002.3307512900.00007FF8A8EF5000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2055969540.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3308615266.00007FF8B8B09000.00000002.00000001.01000000.0000000E.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: 0jNz7djbpp.exe, 00000000.00000003.2054608408.0000016995635000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060982878.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3306195847.00007FF8A8B84000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058243770.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2093052319.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3303682517.00007FF8A819F000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: 0jNz7djbpp.exe, 00000002.00000002.3305271995.00007FF8A86C1000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: 0jNz7djbpp.exe, 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059538255.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059009558.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2055790293.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3309185509.00007FF8B8CB6000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2057015645.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059828437.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2054452813.0000016995635000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058767806.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060508345.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3305271995.00007FF8A86C1000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059156566.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2091445307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3309819998.00007FF8B9843000.00000002.00000001.01000000.0000000F.sdmp, select.pyd.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058940627.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2061053867.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-312\Release\win32api.pdb!! source: win32api.pyd.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059309779.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059678451.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2059397415.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058149992.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: 0jNz7djbpp.exe, 00000000.00000003.2055588390.0000016995636000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3308790009.00007FF8B8B3C000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060691291.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058669882.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2055891789.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3309322062.00007FF8B8F73000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3310216576.00007FF8BA4F4000.00000002.00000001.01000000.0000000C.sdmp, _wmi.pyd.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2058433547.0000016995637000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: 0jNz7djbpp.exe, 00000000.00000003.2056591163.0000016995637000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3310216576.00007FF8BA4F4000.00000002.00000001.01000000.0000000C.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2089260469.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299367779.0000014DF3BC0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060362049.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 0jNz7djbpp.exe, 00000000.00000003.2060910371.0000016995637000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: 0jNz7djbpp.exe, 00000002.00000002.3308015574.00007FF8B78AD000.00000002.00000001.01000000.00000012.sdmp, _ssl.pyd.0.dr

Source: 0jNz7djbpp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 0jNz7djbpp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 0jNz7djbpp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 0jNz7djbpp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 0jNz7djbpp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140_1.dll.0.dr

Static PE information: 0xFB76EAA0 [Mon Sep 10 13:35:28 2103 UTC]

Source: 0jNz7djbpp.exe	Static PE information: section name: _RDATA
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.dr	Static PE information: section name: .xdata
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.dr	Static PE information: section name: /4
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.dr	Static PE information: section name: /19
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.dr	Static PE information: section name: /31
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.dr	Static PE information: section name: /45
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.dr	Static PE information: section name: /57
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.dr	Static PE information: section name: /70
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.dr	Static PE information: section name: /81
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECC5004 push rsp; retf	0_2_00007FF73ECC5005
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81D4021 push rcx; ret	2_2_00007FF8A81D4022
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E6F970 push rdi; ret	2_2_00007FF8A8E6F976
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E69D25 push rdi; ret	2_2_00007FF8A8E69D2B
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E6F25D push rdi; ret	2_2_00007FF8A8E6F264
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B2D3E8 push rbp; iretd	2_2_00007FF8B8B2D3ED

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Process created: "C:\Users\user\Desktop\0jNz7djbpp.exe"

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\win32\win32pdh.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_mt19937.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\core\_multiarray_umath.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imaging.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingtk.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_pcg64.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\core\_multiarray_tests.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_sfc64.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingmath.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_generator.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingcms.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_philox.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\linalg\_umath_linalg.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\mtrand.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\bit_generator.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_webp.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_bounded_integers.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_common.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy.libs\libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\fft\_pocketfft_internal.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI23522\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (132).png

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Code function: 0_2_00007FF73EC86EF0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF73EC86EF0

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\win32\win32pdh.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_mt19937.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\core\_multiarray_umath.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imaging.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingtk.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\psutil\_psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_pcg64.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\core\_multiarray_tests.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_sfc64.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingmath.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_generator.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingcms.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_philox.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\win32\win32crypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\linalg\_umath_linalg.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\mtrand.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\bit_generator.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_webp.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_bounded_integers.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_common.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy.libs\libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\fft\_pocketfft_internal.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI23522\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-16376

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

API coverage: 0.9 %

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC97E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF73EC97E4C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC888D0 FindFirstFileExW,FindClose,	0_2_00007FF73EC888D0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73ECA1EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF73ECA1EE4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC97E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF73EC97E4C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8EB304C FindFirstFileExW,FindNextFileW,FindClose,	2_2_00007FF8A8EB304C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8EB3290 FindFirstFileExW,FindNextFileW,FindClose,	2_2_00007FF8A8EB3290

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Code function: 2_2_00007FF8B93D0150 GetSystemInfo,VirtualAlloc,

2_2_00007FF8B93D0150

Source: 0jNz7djbpp.exe, 00000000.00000003.2061558632.0000016995637000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: 0jNz7djbpp.exe, 00000002.00000002.3302461903.0000014DF597C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: hGfsocks5
Source: 0jNz7djbpp.exe, 00000002.00000002.3299717589.0000014DF4010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Code function: 0_2_00007FF73EC8C57C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF73EC8C57C

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Code function: 0_2_00007FF73ECA3AF0 GetProcessHeap,

0_2_00007FF73ECA3AF0

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC8C760 SetUnhandledExceptionFilter,	0_2_00007FF73EC8C760
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC8C57C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF73EC8C57C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC9ABD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF73EC9ABD8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 0_2_00007FF73EC8BCE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF73EC8BCE0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8093068 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8A8093068
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8092AA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8A8092AA0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A81B2126 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8A81B2126
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8EB0F30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8A8EB0F30
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8A8E898F4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8A8E898F4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78142E8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B78142E8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B7813D20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B7813D20
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B7834090 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B7834090
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B7834660 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B7834660
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78A26A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B78A26A0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B78A30E8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B78A30E8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B7DE1C20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B7DE1C20
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B7DE21F0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B7DE21F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B7E3FFF8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B7E3FFF8
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B7E3FA30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B7E3FA30
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B03398 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B8B03398
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B02DD0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B8B02DD0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B33710 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B8B33710
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B33CE0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B8B33CE0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8C11A00 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B8C11A00
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8C11430 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B8C11430
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8CB19D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B8CB19D0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8CB1FA0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B8CB1FA0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8F71AC0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B8F71AC0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8F714F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B8F714F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8F8AB08 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B8F8AB08
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8F8A0C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B8F8A0C0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B93C6554 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B93C6554
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B93C5FB0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B93C5FB0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B9841AC0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B9841AC0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B98414F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B98414F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B9F70AA8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8B9F70AA8

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Process created: C:\Users\user\Desktop\0jNz7djbpp.exe "C:\Users\user\Desktop\0jNz7djbpp.exe"

Jump to behavior

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Code function: 0_2_00007FF73ECA9E40 cpuid

0_2_00007FF73ECA9E40

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00007FF8A8EAFA58
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: EnterCriticalSection,EnumSystemLocalesW,LeaveCriticalSection,	2_2_00007FF8A8EAD2F0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	2_2_00007FF8A8EAF3D4
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: EnumSystemLocalesW,	2_2_00007FF8A8EAF36C
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	2_2_00007FF8A8EAF488
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: GetProcAddress,GetLocaleInfoW,	2_2_00007FF8A8E5D5C0
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00007FF8A8EAF8D0

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\core VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\numpy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\_wmi.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\_asyncio.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI23522\_overlapped.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Queries volume information: C:\Users\user\Desktop\0jNz7djbpp.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Code function: 0_2_00007FF73EC8C460 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF73EC8C460

Source: C:\Users\user\Desktop\0jNz7djbpp.exe

Code function: 0_2_00007FF73ECA6370 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF73ECA6370

Stealing of Sensitive Information

Yara detected Generic Python Stealer

Source: Yara match

File source: Process Memory Space: 0jNz7djbpp.exe PID: 3128, type: MEMORYSTR

Remote Access Functionality

Yara detected Generic Python Stealer

Source: Yara match

File source: Process Memory Space: 0jNz7djbpp.exe PID: 3128, type: MEMORYSTR

Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B05074 PySys_Audit,PyEval_SaveThread,bind,PyEval_RestoreThread,_Py_NoneStruct,	2_2_00007FF8B8B05074
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8B06078 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,listen,PyEval_RestoreThread,_Py_NoneStruct,	2_2_00007FF8B8B06078
Source: C:\Users\user\Desktop\0jNz7djbpp.exe	Code function: 2_2_00007FF8B8CB2A8C bind,WSAGetLastError,_Py_NoneStruct,PyExc_ValueError,PyErr_SetString,	2_2_00007FF8B8CB2A8C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	34 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0jNz7djbpp.exe	16%	ReversingLabs	Win32.Ransomware.PythonStealer
0jNz7djbpp.exe	100%	Avira	TR/PSW.Agent.vgtlf

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imaging.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingcms.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingmath.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingtk.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_webp.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_cffi_backend.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-private-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\charset_normalizer\md.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI23522\libcrypto-3.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://repository.swisssign.com/0	0%	Avira URL Cloud	safe
https://requests.readthedocs.ioxep%	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
httpbin.org	34.224.200.202	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot	0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.telegram.org/botz	0jNz7djbpp.exe, 00000002.00000003.2111080086.0000014DF438F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111011723.0000014DF4389000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300058980.0000014DF4368000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	0jNz7djbpp.exe, 00000002.00000002.3300112896.0000014DF4410000.00000004.00001000.00020000.00000000.sdmp	false		high
http://aka.ms/vcpython27	0jNz7djbpp.exe, 00000002.00000002.3300788421.0000014DF4A60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/JUMP/	0jNz7djbpp.exe, 00000000.00000003.2087623431.0000016995639000.00000004.00000020.00020000.00000000.sdmp, _mt19937.cp312-win_amd64.pyd.0.dr	false		high
https://github.com/mhammond/pywin32	0jNz7djbpp.exe, 00000000.00000002.3298672667.0000016995646000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093637975.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2091233599.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2094058307.0000016995639000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2093766483.0000016995639000.00000004.00000020.00020000.00000000.sdmp, win32api.pyd.0.dr, pywintypes312.dll.0.dr, win32pdh.pyd.0.dr	false		high
http://crl.dhimyotis.com/certignarootca.crl0	0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://web.archive.org/web/20090514091424/http://brighton-webs.co.uk:80/distributions/rayleigh.asp	_generator.cp312-win_amd64.pyd.0.dr	false		high
http://mathworld.wolfram.com/NoncentralF-Distribution.html	_generator.cp312-win_amd64.pyd.0.dr	false		high
https://gist.github.com/imneme/540829265469e673d045	bit_generator.cp312-win_amd64.pyd.0.dr	false		high
http://repository.swisssign.com/0	0jNz7djbpp.exe, 00000002.00000002.3298673525.0000014DF1D88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.python.org/library/unittest.html	0jNz7djbpp.exe, 00000002.00000003.2110910270.0000014DF428A000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF427C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/	0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0jNz7djbpp.exe, 00000002.00000002.3299099681.0000014DF3880000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3298673525.0000014DF1E0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/actions?query=workflow%3ACI	0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	0jNz7djbpp.exe, 00000000.00000003.2062112050.000001699563B000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2062200984.0000016995646000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000000.00000003.2062112050.0000016995646000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	false		high
https://packaging.python.org/en/latest/specifications/core-metadata/	0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3E72000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2106294038.0000014DF3EAC000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2107852422.0000014DF3E9B000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2105480166.0000014DF3EAC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	0jNz7djbpp.exe, 00000002.00000002.3300531836.0000014DF4860000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mathworld.wolfram.com/LaplaceDistribution.html	_generator.cp312-win_amd64.pyd.0.dr	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300291942.0000014DF4650000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ipinfo.io/json	0jNz7djbpp.exe, 00000002.00000002.3302461903.0000014DF59B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr#r$Nrjr	0jNz7djbpp.exe, 00000002.00000003.2103519400.0000014DF3EAC000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103172660.0000014DF3E84000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103055909.0000014DF4011000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	0jNz7djbpp.exe, 00000002.00000002.3302190026.0000014DF56C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crlU	0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.kill	0jNz7djbpp.exe, 00000002.00000002.3302015458.0000014DF54C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/platformdirs/platformdirs	0jNz7djbpp.exe, 00000002.00000002.3300195894.0000014DF4530000.00000004.00001000.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0205/	0jNz7djbpp.exe, 00000002.00000003.2104650574.0000014DF3E39000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300112896.0000014DF4410000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2104160922.0000014DF3E39000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2104160922.0000014DF3D32000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2097764926.0000014DF394F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2098074179.0000014DF394F000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
http://crl.dhimyotis.com/certignarootca.crl	0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D43000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	0jNz7djbpp.exe, 00000002.00000002.3302190026.0000014DF56C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.accv.es	0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	0jNz7djbpp.exe, 00000002.00000002.3302015458.0000014DF54C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://personal.math.ubc.ca/~cbm/aands/page_67.htm	_multiarray_umath.cp312-win_amd64.pyd.0.dr	false		high
http://arxiv.org/abs/1805.10941.	_generator.cp312-win_amd64.pyd.0.dr	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	0jNz7djbpp.exe, 00000002.00000002.3302190026.0000014DF56C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	0jNz7djbpp.exe, 00000002.00000002.3298992829.0000014DF37FC000.00000004.00001000.00020000.00000000.sdmp	false		high
https://numpy.org/devdocs/user/troubleshooting-importerror.html#c-api-incompatibility	_sfc64.cp312-win_amd64.pyd.0.dr	false		high
https://httpbin.org/get	0jNz7djbpp.exe, 00000002.00000002.3302300225.0000014DF57C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.itl.nist.gov/div898/handbook/eda/section3/eda3666.htm	_generator.cp312-win_amd64.pyd.0.dr	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr#	0jNz7djbpp.exe, 00000002.00000003.2103519400.0000014DF3EAC000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103172660.0000014DF3E84000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103055909.0000014DF4011000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/entry-points/	0jNz7djbpp.exe, 00000002.00000002.3300531836.0000014DF4860000.00000004.00001000.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access	0jNz7djbpp.exe, 00000002.00000003.2103568266.0000014DF3E84000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103172660.0000014DF3E84000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299099681.0000014DF38D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mathworld.wolfram.com/NegativeBinomialDistribution.html	_generator.cp312-win_amd64.pyd.0.dr	false		high
https://pypi.org/project/build/).	0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	0jNz7djbpp.exe, 00000002.00000002.3299099681.0000014DF3880000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3298673525.0000014DF1E0B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://foo/bar.tgz	0jNz7djbpp.exe, 00000002.00000002.3300291942.0000014DF4650000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300531836.0000014DF4860000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	0jNz7djbpp.exe, 00000002.00000003.2103942033.0000014DF3E59000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103812799.0000014DF4050000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299099681.0000014DF38D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.itl.nist.gov/div898/software/dataplot/refman2/auxillar/powpdf.pdf	_generator.cp312-win_amd64.pyd.0.dr	false		high
https://httpbin.org/	0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3D48000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	0jNz7djbpp.exe, 00000000.00000003.2062112050.000001699563B000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	false		high
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://wwww.certigna.fr/autorites/	0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz	0jNz7djbpp.exe, 00000002.00000003.2106229554.0000014DF4128000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2106229554.0000014DF40D9000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2107676215.0000014DF4128000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.html	bit_generator.cp312-win_amd64.pyd.0.dr	false		high
https://busquedasxurl.com/login/conexion/bloqueadoreslogs.php?ip=	0jNz7djbpp.exe, 00000002.00000003.2111080086.0000014DF438F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111011723.0000014DF4389000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300058980.0000014DF4368000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.	0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crllication	0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	0jNz7djbpp.exe, 00000002.00000002.3300952815.0000014DF4CE3000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF4102000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/installation/	0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	0jNz7djbpp.exe, 00000002.00000002.3299099681.0000014DF3880000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3298673525.0000014DF1E0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://web.archive.org/web/20090423014010/http://www.brighton-webs.co.uk:80/distributions/wald.asp	_generator.cp312-win_amd64.pyd.0.dr	false		high
https://www.python.org/psf/license/	0jNz7djbpp.exe, 00000002.00000002.3306793258.00007FF8A8CFC000.00000008.00000001.01000000.00000005.sdmp	false		high
http://mathworld.wolfram.com/CauchyDistribution.html	_generator.cp312-win_amd64.pyd.0.dr	false		high
http://mathworld.wolfram.com/HypergeometricDistribution.html	_generator.cp312-win_amd64.pyd.0.dr	false		high
https://docs.python.org/3/library/multiprocessing.html	0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3E72000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mathworld.wolfram.com/PoissonDistribution.html	_generator.cp312-win_amd64.pyd.0.dr	false		high
http://crl.securetrust.com/STCA.crl	0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wwwsearch.sf.net/):	0jNz7djbpp.exe, 00000002.00000002.3300952815.0000014DF4CE3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D9D000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm	0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	0jNz7djbpp.exe, 00000002.00000002.3302190026.0000014DF56C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/security/	0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
http://crl.xrampsecurity.com/XGCA.crl0	0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D43000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue44497.	0jNz7djbpp.exe, 00000002.00000002.3300291942.0000014DF4650000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/pkg_resources.html	0jNz7djbpp.exe, 00000002.00000003.2103375897.0000014DF3973000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2103172660.0000014DF3E84000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	0jNz7djbpp.exe, 00000002.00000003.2110910270.0000014DF428A000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF427C000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3299802435.0000014DF40E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	0jNz7djbpp.exe, 00000002.00000002.3300291942.0000014DF4650000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300392415.0000014DF4760000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/jaraco/jaraco.functools/issues/5	0jNz7djbpp.exe, 00000002.00000002.3300651931.0000014DF4960000.00000004.00001000.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300112896.0000014DF4410000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es00	0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D9D000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/)	0jNz7djbpp.exe, 00000002.00000002.3306195847.00007FF8A8B84000.00000002.00000001.01000000.00000005.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	0jNz7djbpp.exe, 00000002.00000002.3298673525.0000014DF1E0B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://requests.readthedocs.ioxep%	0jNz7djbpp.exe, 00000002.00000002.3302461903.0000014DF591C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pyca/cryptography/issues	METADATA.0.dr	false		high
https://readthedocs.org/projects/cryptography/badge/?version=latest	0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	0jNz7djbpp.exe, 00000002.00000002.3302190026.0000014DF56C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	0jNz7djbpp.exe, 00000002.00000003.2111080086.0000014DF438F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111011723.0000014DF4389000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300058980.0000014DF4368000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	0jNz7djbpp.exe, 00000002.00000003.2111125616.0000014DF4D71000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300952815.0000014DF4CE3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4D43000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.inference.org.uk/mackay/itila/	_generator.cp312-win_amd64.pyd.0.dr	false		high
http://mathworld.wolfram.com/BinomialDistribution.html	_generator.cp312-win_amd64.pyd.0.dr	false		high
http://crl.securetrust.com/SGCA.crl	0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.../back.jpeg	0jNz7djbpp.exe, 00000002.00000002.3301040018.0000014DF4F2F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3302300225.0000014DF57C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	0jNz7djbpp.exe, 00000002.00000002.3299497026.0000014DF3CF0000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111080086.0000014DF438F000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111154878.0000014DF3D9A000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000003.2111011723.0000014DF4389000.00000004.00000020.00020000.00000000.sdmp, 0jNz7djbpp.exe, 00000002.00000002.3300058980.0000014DF4368000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography	0jNz7djbpp.exe, 00000000.00000003.2062300667.000001699563B000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://www.python.org/download/releases/2.3/mro/.	0jNz7djbpp.exe, 00000002.00000002.3298992829.0000014DF3780000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://cryptography.io/	METADATA.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.224.200.202	httpbin.org	United States		14618	AMAZON-AESUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571345
Start date and time:	2024-12-09 10:10:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0jNz7djbpp.exe renamed because original name is a hash value
Original Sample Name:	151e75f3ed3003b63ecbee13741e788b519db99c5253f32a041f501f28688111.exe
Detection:	MAL
Classification:	mal76.troj.winEXE@3/102@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
VT rate limit hit for: 0jNz7djbpp.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.224.200.202	7EznMik8Fw.exe	Get hash	malicious	Python Stealer	Browse
	MkWMm5piE5.exe	Get hash	malicious	Python Stealer	Browse
	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse
	JxrkpYVdCp.exe	Get hash	malicious	Python Stealer, Babadeda	Browse
	u08NgsGNym.exe	Get hash	malicious	Python Stealer	Browse
	L5OMdZqWzq.exe	Get hash	malicious	Python Stealer	Browse
	ssPp3zvWwN.exe	Get hash	malicious	Python Stealer	Browse
	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse
	11lbKZLNnQ.exe	Get hash	malicious	Python Stealer	Browse
	r2PcRF79Mo.exe	Get hash	malicious	Python Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
httpbin.org	7EznMik8Fw.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	MkWMm5piE5.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	JxrkpYVdCp.exe	Get hash	malicious	Python Stealer, Babadeda	Browse	34.224.200.202
	u08NgsGNym.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	MkWMm5piE5.exe	Get hash	malicious	Python Stealer	Browse	44.196.3.45
	L5OMdZqWzq.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	ssPp3zvWwN.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	I6H1RkEHlX.exe	Get hash	malicious	Python Stealer	Browse	44.196.3.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	7EznMik8Fw.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	MkWMm5piE5.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	JxrkpYVdCp.exe	Get hash	malicious	Python Stealer, Babadeda	Browse	34.224.200.202
	u08NgsGNym.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	MkWMm5piE5.exe	Get hash	malicious	Python Stealer	Browse	44.196.3.45
	L5OMdZqWzq.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	ssPp3zvWwN.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse	34.224.200.202
	I6H1RkEHlX.exe	Get hash	malicious	Python Stealer	Browse	44.196.3.45

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imaging.cp312-win_amd64.pyd	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse
	JxrkpYVdCp.exe	Get hash	malicious	Python Stealer, Babadeda	Browse
	hSyJxPUUDx.exe	Get hash	malicious	Unknown	Browse
	u08NgsGNym.exe	Get hash	malicious	Python Stealer	Browse
	okG6LaM2yP.exe	Get hash	malicious	Python Stealer	Browse
	d7rnBT699m.exe	Get hash	malicious	Unknown	Browse
	33sKdwH6im.exe	Get hash	malicious	Python Stealer	Browse
	KkgQY27Qqn.exe	Get hash	malicious	Unknown	Browse
	Windows.exe	Get hash	malicious	Python Stealer	Browse
	CrowdStrike Falcon.exe	Get hash	malicious	Python Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imaging.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2582528
Entropy (8bit):	6.457978211619077
Encrypted:	false
SSDEEP:	49152:ahLabo89HhLGC4BmK7y9VnuEILrLrLrL6mV6i:XJlK7yg
MD5:	0376776F076CD4F4AC15EC4D813C5470
SHA1:	381F84735A11ACE4673D8BE53138E652D4415413
SHA-256:	A7DDF4D7CAB08676BB88A42059353C5374600901B3AB880E17EE1A0D0150C380
SHA-512:	06D68B9E5DAF90D05855BF2C57B6110BFC2F20F4731B023B5AAA39145FD3AB66525D39988B8516731045AD16A89EB0457487DD080AEB347BA24A2E47ECE98BBD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: okG6LaM2yP.exe, Detection: malicious, Browse Filename: JxrkpYVdCp.exe, Detection: malicious, Browse Filename: hSyJxPUUDx.exe, Detection: malicious, Browse Filename: u08NgsGNym.exe, Detection: malicious, Browse Filename: okG6LaM2yP.exe, Detection: malicious, Browse Filename: d7rnBT699m.exe, Detection: malicious, Browse Filename: 33sKdwH6im.exe, Detection: malicious, Browse Filename: KkgQY27Qqn.exe, Detection: malicious, Browse Filename: Windows.exe, Detection: malicious, Browse Filename: CrowdStrike Falcon.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........%.}.v.}.v.}.v..)v.}.v...w.}.v..Gv.}.v...w.}.v...w.}.v...w.}.vw..w.}.v...w.}.v.}.v.\|.v.}.v.}.v...w.\|.v...w.}.v...w.}.v..Ev.}.v...w.}.vRich.}.v........................PE..d.....e.........." ...%.............X........................................'...........`......................................... .%.`.....%.......'.......&...............'.....P{$......................{$.(....z$.@............................................text...X........................... ..`.rdata...).......*..................@..@.data........&..`....%.............@....pdata........&......D&.............@..@.rsrc.........'......P'.............@..@.reloc........'......R'.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingcms.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.291831001741347
Encrypted:	false
SSDEEP:	6144:gQG8+hL4/nOYRI7O0hdlnLg9uP1+74/LgHmPr9qvZqhLaHLTLrLfqeqwL1dQ5hz0:gQG8z/shdlnLg9uP1+74/LgHmPr9qvZr
MD5:	48F7F14636DA0BC081A34ACBFE30D77D
SHA1:	E38B1F4E6F42219CC2D31D7EAF4FD49A8AD36D69
SHA-256:	3C2CEDEBABB5748F78FBA56634FD49CDAAD02C18D808D7E2B4F50E2800C7930F
SHA-512:	7C077CB4727E5879598D0DDACF4507806C66980C8E312F2A3861BC6448D5802F99F01535E9C2ECDF78F700DB78B3F03BC3989E81F28A57398F4AD8E9E1FDA7F3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V[jw8.jw8.jw8.c...dw8...9.hw8...=.gw8...<.bw8...;.nw8...9.hw8.!.9.mw8.jw9..w8.P.0.\|w8.P.8.kw8.P...kw8.P.:.kw8.Richjw8.........PE..d.....e.........." ...%..... ...............................................@............`......................................... ...h............ ..........4/...........0.......`..............................p_..@...............p............................text...h........................... ..`.rdata..............................@..@.data....?.......:..................@....pdata..4/.......0..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingmath.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.547840685902378
Encrypted:	false
SSDEEP:	384:WuwU58R4Pp/4TsXlCr8AN+I6iYLz9IKVxgyJ+X9:Hp8Rs4TWCr8vHH97V6P9
MD5:	8F67156CE61C7DE23E19F9445C8BA504
SHA1:	B9E344FE41B3FC77CE0012930B7ED9AF47EB500C
SHA-256:	8287A2A551BD99B5D55E18E461FEDB3704B74B0FB60F1E0881C792F90A18CE46
SHA-512:	F70F24CEF7475547F5B29D1AE6DB7BD1DE6D1AA906E21705E40ED5C18F4F059CE9BB14DFD353776EFC08B985881A102DEA1948632EDCCACF76CC72D126651EB0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@......@...A...@..A...@...E...@...D...@...C...@.[.A...@...A...@..`H...@..`@...@..`....@..`B...@.Rich..@.........PE..d.....e.........." ...%.6...,......P9....................................................`.........................................``..h....`..x...............P...............@....U...............................S..@............P..`............................text...(4.......6.................. ..`.rdata.. ....P.......:..............@..@.data........p.......R..............@....pdata..P............T..............@..@.rsrc................\..............@..@.reloc..@............^..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingtk.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	4.947735133076573
Encrypted:	false
SSDEEP:	192:Eq/Ztwurp+xOkpDds0KpbQoSM8WEumw/vE9FWckgTJ5:NZLaDFKpcoSIk9OgT
MD5:	7E912D07A39E16BB25CF32B7153515C8
SHA1:	60B2020DA661C6526FB09BCBCA6456520480BCAD
SHA-256:	D1E5D023821A9C38967FFAA9BDBF4DDE998A3A6BC37942CA334A13E55A1FC711
SHA-512:	EB47383DF193573AE5788023ACE576199F8BB0506406A95A26CD3CA688D0AF66E3E24EB13A9811B08932B81603848E70660BBD6806222C09749BFC0858A668E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s>H..mH..mH..mA.mB..m]..lJ..m]..lD..m]..l@..m]..lK..m...lJ..m...lM..mH..m\|..mr5.lJ..mr5.lI..mr5.mI..mr5.lI..mRichH..m................PE..d.....e.........." ...%.....$......@.....................................................`..........................................;..d....;.......p.......`..................<...`5.............................. 4..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data........P.......0..............@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc..<............8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_webp.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	534528
Entropy (8bit):	6.582425403943618
Encrypted:	false
SSDEEP:	12288:HsQIgnVCZh4nbXy8mAC1tQzLrLrLrLWmE5Gx0Hs/JJY:Hs4wwnbXBzLrLrLrLWmE60Hs/J+
MD5:	12D05951F8004E24EEAA0E45D587FE8E
SHA1:	CB42E43B3E55A18F765657BD436A566BA73747A3
SHA-256:	D96B196126A033F1D7832E29CEE44928683FAB00242E812815FF95FFFED1AF54
SHA-512:	3622C6E537096CCA34A6097E2BF8DE7477DC8B1333360B57F1DC0665147746A837F0B82EBAD06A8304B363F85E140FEFBDA2353D74B024208FF4124844029C47
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l....w...w...w..u....w..rv...w..uv...w..rr...w..rs...w..rt...w..pv...w...v...w..s...w......w..w...w.....w..u...w.Rich..w.........................PE..d.....e.........." ...%..................................................................`.........................................P...\............p....... ...N..................`W.............................. V..@............................................text............................... ..`.rdata..............................@..@.data....2..........................@....pdata...N... ...P..................@..@.rsrc........p.......$..............@..@.reloc...............&..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49528
Entropy (8bit):	6.662491747506177
Encrypted:	false
SSDEEP:	768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5:	F8DFA78045620CF8A732E67D1B1EB53D
SHA1:	FF9A604D8C99405BFDBBF4295825D3FCBC792704
SHA-256:	A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
SHA-512:	BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...\|!..{.&.\|!..{...\|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71448
Entropy (8bit):	6.247581706260346
Encrypted:	false
SSDEEP:	1536:rRaPPkDN3nkiP6djtX5IkTIL1yUvGJtIAOnT7SyqWx5:9anmN3nkikjV5IkTIL1yUuJtIAOnTgi
MD5:	209CBCB4E1A16AA39466A6119322343C
SHA1:	CDCCE6B64EBF11FECFF739CBC57E7A98D6620801
SHA-256:	F7069734D5174F54E89B88D717133BFF6A41B01E57F79957AB3F02DAA583F9E2
SHA-512:	5BBC4EDE01729E628260CF39DF5809624EAE795FD7D51A1ED770ED54663955674593A97B78F66DBF6AE268186273840806ED06D6F7877444D32FDCA031A9F0DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.T.S...S...S...+r..S...,...S...,...S...,...S...,...S..$....S..U+...S...S...S..$....S..$....S..$....S..$....S..Rich.S..........PE..d......e.........." ...%.f................................................... ......')....`.............................................P......d......................../..............T...........................@...@............................................text...=d.......f.................. ..`.rdata..pO.......P...j..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84760
Entropy (8bit):	6.5874715807724025
Encrypted:	false
SSDEEP:	1536:RS7z7Sj2u5in5IVfC83zYxzbdK87kW1IACVw7SyrxX:I7z+jum3MJdN7kW1IACVwX
MD5:	59D60A559C23202BEB622021AF29E8A9
SHA1:	A405F23916833F1B882F37BDBBA2DD799F93EA32
SHA-256:	706D4A0C26DD454538926CBB2FF6C64257C3D9BD48C956F7CABD6DEF36FFD13E
SHA-512:	2F60E79603CF456B2A14B8254CEC75CE8BE0A28D55A874D4FB23D92D63BBE781ED823AB0F4D13A23DC60C4DF505CBF1DBE1A0A2049B02E4BDEC8D374898002B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R...S..R.....R...W..R...V..R...Q..R...S..R..S..R..S..R..._..R...R..R......R...P..R.Rich.R.........................PE..d......e.........." ...%.....^......\|........................................P......-B....`.............................................H............0....... ..,......../...@..........T...........................p...@............................................text...k........................... ..`.rdata..p>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_cffi_backend.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	182784
Entropy (8bit):	6.193615170968096
Encrypted:	false
SSDEEP:	3072:YRAMUp3K6YoDssyudy4VcRG+nR3hnW3mjwwOdkS9S7iSSTLkK/jftw3buz:Y6MyK65ssy+MG+LnSUwjD9zSSTLL/jl8
MD5:	0572B13646141D0B1A5718E35549577C
SHA1:	EEB40363C1F456C1C612D3C7E4923210EAE4CDF7
SHA-256:	D8A76D1E31BBD62A482DEA9115FC1A109CB39AF4CF6D1323409175F3C93113A7
SHA-512:	67C28432CA8B389ACC26E47EB8C4977FDDD4AF9214819F89DF07FECBC8ED750D5F35807A1B195508DD1D77E2A7A9D7265049DCFBFE7665A7FD1BA45DA1E4E842
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I.C.I.C.I.C.1MC.I.C.<.B.I.C.&#C.I.C.<.B.I.C.<.B.I.C.<.B.I.C.1.B.I.C.4.B.I.C.I.C I.C.<.B.I.C.1KC.I.C.<.B.I.C.<!C.I.C.<.B.I.CRich.I.C................PE..d...g..e.........." .........@......`........................................@............`..........................................w..l....w....... ..........l............0.......]...............................]..8............................................text............................... ..`.rdata..............................@..@.data...h].......0...\|..............@....pdata..l...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.128664719423826
Encrypted:	false
SSDEEP:	3072:DGR936Xz4mHFK0K+bRFOoP+Szlf/EZZBKYyucV6rOoZIALPEA:qQHLK+bvvPNhf/Ei6CoX
MD5:	2A834C3738742D45C0A06D40221CC588
SHA1:	606705A593631D6767467FB38F9300D7CD04AB3E
SHA-256:	F20DFA748B878751EA1C4FE77A230D65212720652B99C4E5577BCE461BBD9089
SHA-512:	924235A506CE4D635FA7C2B34E5D8E77EFF73F963E58E29C6EF89DB157BF7BAB587678BB2120D09DA70594926D82D87DBAA5D247E861E331CF591D45EA19A117
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......x...<...<...<...5.*.:...)...>...)...0...)...4...)...8.......>...w...=...w...:.......?...<..........:.......=.....F.=.......=...Rich<...........................PE..d......e.........." ...%............p_..............................................]R....`.........................................``.......`.........................../......p.......T...............................@............................................text............................... ..`.rdata..Xl.......n..................@..@.data....4.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	252696
Entropy (8bit):	6.564448148079112
Encrypted:	false
SSDEEP:	6144:Agvd9YyMipyD41q8xDiw9qWM53pLW1AQRRRrBoZtcr3:AQ8yryD47hix4orcr3
MD5:	F930B7550574446A015BC602D59B0948
SHA1:	4EE6FF8019C6C540525BDD2790FC76385CDD6186
SHA-256:	3B9AD1D2BC9EC03D37DA86135853DAC73B3FE851B164FE52265564A81EB8C544
SHA-512:	10B864975945D6504433554F9FF11B47218CAA00F809C6BCE00F9E4089B862190A4219F659697A4BA5E5C21EDBE1D8D325950921E09371ACC4410469BD9189EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mBP\.,.\.,.\.,.Ut..R.,.Is-.^.,.Is).Q.,.Is(.T.,.Is/.X.,.f.-._.,..t-.^.,.\.-...,.f./.].,.f.!.S.,.f.,.].,.f...].,.f...].,.Rich\.,.........PE..d......e.........." ...%.t...<......................................................6.....`.........................................@T..P....T..................0'......./......P...@...T...............................@............................................text....r.......t.................. ..`.rdata...............x..............@..@.data....*...p...$...P..............@....pdata..0'.......(...t..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65816
Entropy (8bit):	6.242741772115205
Encrypted:	false
SSDEEP:	1536:MElYij3wz91lBafLEmIRhtIAOIW7SybpxC:hYZBaTEmghtIAOIWE
MD5:	B0262BD89A59A3699BFA75C4DCC3EE06
SHA1:	EB658849C646A26572DEA7F6BFC042CB62FB49DC
SHA-256:	4ADFBBD6366D9B55D902FC54D2B42E7C8C989A83016ED707BD7A302FC3FC7B67
SHA-512:	2E4B214DE3B306E3A16124AF434FF8F5AB832AA3EEB1AA0AA9B49B0ADA0928DCBB05C57909292FBE3B01126F4CD3FE0DAC9CC15EAEA5F3844D6E267865B9F7B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........u...&...&...&.}&...&..'...&..'...&..'...&..'...&...'...&.x.'...&...&}..&.x.'...&.x.'...&.x.&...&.x.'...&Rich...&........................PE..d.....e.........." ...%.T..........P@....................................................`.............................................P.............................../......X...@}..T............................\|..@............p..(............................text....S.......T.................. ..`.rdata..&O...p...P...X..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159512
Entropy (8bit):	6.846323229710623
Encrypted:	false
SSDEEP:	3072:Fik7me1FFD+znfF9mNo+Mu6tmxzE41IAZ1Ak:FikSiUNYO+J1E4b
MD5:	B71DBE0F137FFBDA6C3A89D5BCBF1017
SHA1:	A2E2BDC40FDB83CC625C5B5E8A336CA3F0C29C5F
SHA-256:	6216173194B29875E84963CD4DC4752F7CA9493F5B1FD7E4130CA0E411C8AC6A
SHA-512:	9A5C7B1E25D8E1B5738F01AEDFD468C1837F1AC8DD4A5B1D24CE86DCAE0DB1C5B20F2FF4280960BC523AEE70B71DB54FD515047CDAF10D21A8BEC3EBD6663358
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RH:..)T..)T..)T..Q...)T..VU..)T..VQ..)T..VP..)T..VW..)T.,.U..)T.]QU..)T..)U.s)T.,.Y.,)T.,.T..)T.,....)T.,.V..)T.Rich.)T.........PE..d.....e.........." ...%.d...........6....................................................`......................................... %..L...l%..x....p.......P.......@.../......4.......T...............................@............................................text....b.......d.................. ..`.rdata..............h..............@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35096
Entropy (8bit):	6.461229529356597
Encrypted:	false
SSDEEP:	768:OgYvrenSE0PXxxQ0zi+mdIAWtd5YiSyviCAMxkEj:vYTQShxQ0zlmdIAWtD7SyKAxv
MD5:	4CCBD87D76AF221F24221530F5F035D1
SHA1:	D02B989AAAC7657E8B3A70A6EE7758A0B258851B
SHA-256:	C7BBCFE2511FD1B71B916A22AD6537D60948FFA7BDE207FEFABEE84EF53CAFB5
SHA-512:	34D808ADAC96A66CA434D209F2F151A9640B359B8419DC51BA24477E485685AF10C4596A398A85269E8F03F0FC533645907D7D854733750A35BF6C691DE37799
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........*..y..y..y..y..y...x..y...x..y...x..y...x..y.J.x..y..y..y...x..y.J.x..y.J.x..y.Jky..y.J.x..yRich..y................PE..d......e.........." ...%.....>......P...............................................^.....`.........................................0E..`....E..x............p.......Z.../...........4..T............................3..@............0...............................text............................... ..`.rdata..r ...0..."..."..............@..@.data........`.......D..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55576
Entropy (8bit):	6.342203411267264
Encrypted:	false
SSDEEP:	1536:wXRnts3McbN6w/xzWssXZdR1r3RIAXtI7SyNxQ:IRvcsXZdR1rRIAXtI6
MD5:	61193E813A61A545E2D366439C1EE22A
SHA1:	F404447B0D9BFF49A7431C41653633C501986D60
SHA-256:	C21B50A7BF9DBE1A0768F5030CAC378D58705A9FE1F08D953129332BEB0FBEFC
SHA-512:	747E4D5EA1BDF8C1E808579498834E1C24641D434546BFFDFCF326E0DE8D5814504623A3D3729168B0098824C2B8929AFC339674B0D923388B9DAC66F5D9D996
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.{..w(..w(..w(.s.(..w(.tv)..w(.tr)..w(.ts)..w(.tt)..w(.v)..w(..v(..w(.sv)..w(.ss)..w(.z)..w(.w)..w(..(..w(.u)..w(Rich..w(........................PE..d......e.........." ...%.L...`............................................................`.............................................X...X............................/......(....f..T............................e..@............`...............................text....J.......L.................. ..`.rdata..D8...`...:...P..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.4674944702653665
Encrypted:	false
SSDEEP:	768:0k+cae6rjp5MoNOfZIAQUM5YiSyvjAMxkEKu:5vSjgoNOfZIAQU27SyLxv
MD5:	F3ECA4F0B2C6C17ACE348E06042981A4
SHA1:	EB694DDA8FF2FE4CCAE876DC0515A8EFEC40E20E
SHA-256:	FB57EE6ADF6E7B11451B6920DDD2FB943DCD9561C9EAE64FDDA27C7ED0BC1B04
SHA-512:	604593460666045CA48F63D4B14FA250F9C4B9E5C7E228CC9202E7692C125AACB0018B89FAA562A4197692A9BC3D2382F9E085B305272EE0A39264A2A0F53B75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.\.Sa..Sa..Sa..+...Sa..,`..Sa..,d..Sa..,e..Sa..,b..Sa.$.`..Sa.U+`..Sa..S`.USa.$.l..Sa.$.a..Sa.$...Sa.$.c..Sa.Rich.Sa.........PE..d......e.........." ...%.....8.......................................................I....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..8............................text...(........................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83224
Entropy (8bit):	6.338326324626716
Encrypted:	false
SSDEEP:	1536:MUuhDLiJfz76Xl+1ly+uCt9/s+S+pzcHS58/n1IsJHfsZIALwqw7Syraxi:MU6DL4fHdy+uCt9/sT+pzuSQ1IwHfsZS
MD5:	9C6283CC17F9D86106B706EC4EA77356
SHA1:	AF4F2F52CE6122F340E5EA1F021F98B1FFD6D5B6
SHA-256:	5CC62AAC52EDF87916DEB4EBBAD9ABB58A6A3565B32E7544F672ACA305C38027
SHA-512:	11FD6F570DD78F8FF00BE645E47472A96DAFFA3253E8BD29183BCCDE3F0746F7E436A106E9A68C57CC05B80A112365441D06CC719D51C906703B428A32C93124
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|../8z.\|8z.\|8z.\|1.T\|>z.\|-..}:z.\|-..}5z.\|-..}0z.\|-..};z.\|...}:z.\|8z.\|.z.\|s..}1z.\|...}9z.\|...}9z.\|..8\|9z.\|...}9z.\|Rich8z.\|........PE..d......e.........." ...%.v...........-.......................................`............`.............................................P............@.......0.........../...P..........T...............................@............................................text....u.......v.................. ..`.rdata...x.......z...z..............@..@.data...H...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124696
Entropy (8bit):	6.266006891462829
Encrypted:	false
SSDEEP:	3072:9PfqZRAWgyjwzCO4w5y3DUfUK8PtIAOQMo:oAWgKw2C5iSUv1
MD5:	506B13DD3D5892B16857E3E3B8A95AFB
SHA1:	42E654B36F1C79000084599D49B862E4E23D75FF
SHA-256:	04F645A32B0C58760CC6C71D09224FE90E50409EF5C81D69C85D151DFE65AFF9
SHA-512:	A94F0E9F2212E0B89EB0B5C64598B18AF71B59E1297F0F6475FA4674AE56780B1E586B5EB952C8C9FEBAD38C28AFD784273BBF56645DB2C405AFAE6F472FB65C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................}........................:...................:......:......:......:.....Rich...................PE..d.....e.........." ...%.............................................................d....`.........................................`o..P....o..................8......../.......... ...T...............................@............................................text............................... ..`.rdata..............................@..@.data...8............\|..............@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177432
Entropy (8bit):	5.976892131161338
Encrypted:	false
SSDEEP:	3072:1CRW4ljuyKK8vZktW5No6XfJN54eNWXvM4VRJNI7IM/cbP7RHs3FJZ1IAC7+y:1mfEyKKaZo6XfJ2MSV+JZW
MD5:	DDB21BD1ACDE4264754C49842DE7EBC9
SHA1:	80252D0E35568E68DED68242D76F2A5D7E00001E
SHA-256:	72BB15CD8C14BA008A52D23CDCFC851A9A4BDE13DEEE302A5667C8AD60F94A57
SHA-512:	464520ECD1587F5CEDE6219FAAC2C903EE41D0E920BF3C9C270A544B040169DCD17A4E27F6826F480D4021077AB39A6CBBD35EBB3D71672EBB412023BC9E182A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........wfj...9...9...9.n.9...9.i.8...9.i.8...9.i.8...9.i.8...9...8...9...9U..9.n.8...9...8...9...8...9...9...9...8...9Rich...9........PE..d.....e.........." ...%............\,..............................................t.....`......................................... ...d.......................8......../......x...@...T...............................@............................................text.............................. ..`.rdata...!......."..................@..@.data...(...........................@....pdata..8............^..............@..@.rsrc................j..............@..@.reloc..x............t..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36632
Entropy (8bit):	6.357254511176439
Encrypted:	false
SSDEEP:	768:6cxnHG7MYGQd0hHdzA77yeu1IACis5YiSyvoAMxkE9:6cxnm7M6dAHdzA77yeu1IACiW7Sy+xx
MD5:	C1654EBEBFEEDA425EADE8B77CA96DE5
SHA1:	A4A150F1C810077B6E762F689C657227CC4FD257
SHA-256:	AA1443A715FBF84A84F39BD89707271FC11A77B597D7324CE86FC5CFA56A63A9
SHA-512:	21705B991E75EFD5E59B8431A3B19AE5FCC38A3E7F137A9D52ACD24E7F67D61758E48ABC1C9C0D4314FA02010A1886C15EAD5BCA8DCA1B1D4CCBFC3C589D342E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S..............l..............................z.......................................z.......z.......z.......z......Rich....................PE..d......e.........." ...%.(...:.......&..............................................!n....`..........................................T..H....T...............p..`....`.../......t...DG..T............................C..@............@.......S..@....................text....&.......(.................. ..`.rdata..D....@... ...,..............@..@.data........`.......L..............@....pdata..`....p.......P..............@..@.rsrc................T..............@..@.reloc..t............^..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.608323768366966
Encrypted:	false
SSDEEP:	192:KFOWWthWzWf9BvVVWQ4mWqyVT/gqnajKsrCS81:uZWthWeN01IlGsrCt
MD5:	07EBE4D5CEF3301CCF07430F4C3E32D8
SHA1:	3B878B2B2720915773F16DBA6D493DAB0680AC5F
SHA-256:	8F8B79150E850ACC92FD6AAB614F6E3759BEA875134A62087D5DD65581E3001F
SHA-512:	6C7E4DF62EBAE9934B698F231CF51F54743CF3303CD758573D00F872B8ECC2AF1F556B094503AAE91100189C0D0A93EAF1B7CAFEC677F384A1D7B4FDA2EEE598
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0............`A........................................p...,............ ...................!..............p............................................................................rdata..d...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	6.6074868843808785
Encrypted:	false
SSDEEP:	192:PUWthW6Wf9BvVVWQ4SWZifvXqnajJ6HNbLet:MWthW3NhXll6HZm
MD5:	557405C47613DE66B111D0E2B01F2FDB
SHA1:	DE116ED5DE1FFAA900732709E5E4EEF921EAD63C
SHA-256:	913EAAA7997A6AEE53574CFFB83F9C9C1700B1D8B46744A5E12D76A1E53376FD
SHA-512:	C2B326F555B2B7ACB7849402AC85922880105857C616EF98F7FB4BBBDC2CD7F2AF010F4A747875646FCC272AB8AA4CE290B6E09A9896CE1587E638502BD4BEFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...p.~..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..H...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.622854484071805
Encrypted:	false
SSDEEP:	192:tlWthWFWf9BvVVWQ4mWIzWLiP+CjAWqnajKsNb7:/WthWANnWLiP+CcWlGsNb7
MD5:	624401F31A706B1AE2245EB19264DC7F
SHA1:	8D9DEF3750C18DDFC044D5568E3406D5D0FB9285
SHA-256:	58A8D69DF60ECBEE776CD9A74B2A32B14BF2B0BD92D527EC5F19502A0D3EB8E9
SHA-512:	3353734B556D6EEBC57734827450CE3B34D010E0C033E95A6E60800C0FDA79A1958EBF9053F12054026525D95D24EEC541633186F00F162475CEC19F07A0D817
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...YJ..........." .........................................................0.......s....`A........................................p................ ...................!..............p............................................................................rdata..T...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.670771733256744
Encrypted:	false
SSDEEP:	192:1mxD3+HWthWiWf9BvVVWQ4WWuhD7DiqnajKswz3:19HWthWfN/GlGswz3
MD5:	2DB5666D3600A4ABCE86BE0099C6B881
SHA1:	63D5DDA4CEC0076884BC678C691BDD2A4FA1D906
SHA-256:	46079C0A1B660FC187AAFD760707F369D0B60D424D878C57685545A3FCE95819
SHA-512:	7C6E1E022DB4217A85A4012C8E4DAEE0A0F987E4FBA8A4C952424EF28E250BAC38B088C242D72B4641157B7CC882161AEFA177765A2E23AFCDC627188A084345
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....^[..........." .........................................................0......@^....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15328
Entropy (8bit):	6.561472518225768
Encrypted:	false
SSDEEP:	192:RaNYPvVX8rFTsoWthWgWf9BvVVWQ4SWfMaPOoI80Hy5qnajslBE87QyX:HPvVXqWthWlN2WlslEE87Qw
MD5:	0F7D418C05128246AFA335A1FB400CB9
SHA1:	F6313E371ED5A1DFFE35815CC5D25981184D0368
SHA-256:	5C9BC70586AD538B0DF1FCF5D6F1F3527450AE16935AA34BD7EB494B4F1B2DB9
SHA-512:	7555D9D3311C8622DF6782748C2186A3738C4807FC58DF2F75E539729FC4069DB23739F391950303F12E0D25DF9F065B4C52E13B2EBB6D417CA4C12CFDECA631
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...*.;A.........." .........................................................@.......m....`A........................................p................0...................!..............p............................................................................rdata..<...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.638884356866373
Encrypted:	false
SSDEEP:	192:jlWaWthWAWf9BvVVWQ4WWloprVP+CjAWqnajKsNWqL:jIaWthWFNxtVP+CcWlGsNxL
MD5:	5A72A803DF2B425D5AAFF21F0F064011
SHA1:	4B31963D981C07A7AB2A0D1A706067C539C55EC5
SHA-256:	629E52BA4E2DCA91B10EF7729A1722888E01284EED7DDA6030D0A1EC46C94086
SHA-512:	BF44997C405C2BA80100EB0F2FF7304938FC69E4D7AE3EAC52B3C236C3188E80C9F18BDA226B5F4FDE0112320E74C198AD985F9FFD7CEA99ACA22980C39C7F69
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...=+vj.........." .........................................................0.......N....`A........................................p...L............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11744
Entropy (8bit):	6.744400973311854
Encrypted:	false
SSDEEP:	96:imdzvQzEWthWwMVDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLN5DEs3r:v3WthWyWf9BvVVWQ4SWVVFJqqnajW2y
MD5:	721B60B85094851C06D572F0BD5D88CD
SHA1:	4D0EE4D717AEB9C35DA8621A545D3E2B9F19B4E7
SHA-256:	DAC867476CAA42FF8DF8F5DFE869FFD56A18DADEE17D47889AFB69ED6519AFBF
SHA-512:	430A91FCECDE4C8CC4AC7EB9B4C6619243AB244EE88C34C9E93CA918E54BD42B08ACA8EA4475D4C0F5FA95241E4AACB3206CBAE863E92D15528C8E7C9F45601B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......T`....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	6.638488013343178
Encrypted:	false
SSDEEP:	192:frWthWFWf9BvVVWQ4SWNOfvXqnajJ6H4WJ:frWthWANRXll6H4WJ
MD5:	D1DF480505F2D23C0B5C53DF2E0E2A1A
SHA1:	207DB9568AFD273E864B05C87282987E7E81D0BA
SHA-256:	0B3DFB8554EAD94D5DA7859A12DB353942406F9D1DFE3FAC3D48663C233EA99D
SHA-512:	F14239420F5DD84A15FF5FCA2FAD81D0AA9280C566FA581122A018E10EBDF308AC0BF1D3FCFC08634C1058C395C767130C5ABCA55540295C68DF24FFD931CA0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....(..........." .........................................................0......;.....`A........................................p...`............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12256
Entropy (8bit):	6.588267640761022
Encrypted:	false
SSDEEP:	192:txlkWthW2Wf9BvVVWQ4SWBBBuUgxfzfqnaj0OTWv:txlkWthW7NkIrloFv
MD5:	73433EBFC9A47ED16EA544DDD308EAF8
SHA1:	AC1DA1378DD79762C6619C9A63FD1EBE4D360C6F
SHA-256:	C43075B1D2386A8A262DE628C93A65350E52EAE82582B27F879708364B978E29
SHA-512:	1C28CC0D3D02D4C308A86E9D0BC2DA88333DFA8C92305EC706F3E389F7BB6D15053040AFD1C4F0AA3383F3549495343A537D09FE882DB6ED12B7507115E5A263
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....pi..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..<...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.678828474114903
Encrypted:	false
SSDEEP:	192:4TWthWckWf9BvVVWQ4mWQAyUD7DiqnajKswzjdg:4TWthWcRNqGlGswzji
MD5:	7C7B61FFA29209B13D2506418746780B
SHA1:	08F3A819B5229734D98D58291BE4BFA0BEC8F761
SHA-256:	C23FE8D5C3CA89189D11EC8DF983CC144D168CB54D9EAB5D9532767BCB2F1FA3
SHA-512:	6E5E3485D980E7E2824665CBFE4F1619B3E61CE3BCBF103979532E2B1C3D22C89F65BCFBDDBB5FE88CDDD096F8FD72D498E8EE35C3C2307BACECC6DEBBC1C97F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....\|............" .........................................................0.......3....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.602852377056617
Encrypted:	false
SSDEEP:	192:Us13vuBL3B5LoWthW7Wf9BvVVWQ4mWgB7OQP+CjAWqnajKsN9arO:Us13vuBL3B2WthWmNVXP+CcWlGsN9P
MD5:	6D0550D3A64BD3FD1D1B739133EFB133
SHA1:	C7596FDE7EA1C676F0CC679CED8BA810D15A4AFE
SHA-256:	F320F9C0463DE641B396CE7561AF995DE32211E144407828B117088CF289DF91
SHA-512:	5DA9D490EF54A1129C94CE51349399B9012FC0D4B575AE6C9F1BAFCFCF7F65266F797C539489F882D4AD924C94428B72F5137009A851ECB541FE7FB9DE12FEB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...]. ,.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..X...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14800
Entropy (8bit):	6.528059454770997
Encrypted:	false
SSDEEP:	384:On2OMw3zdp3bwjGfue9/0jCRrndbZWWthWdNHhfVlGsSH:/OMwBprwjGfue9/0jCRrndbLEKv
MD5:	1ED0B196AB58EDB58FCF84E1739C63CE
SHA1:	AC7D6C77629BDEE1DF7E380CC9559E09D51D75B7
SHA-256:	8664222823E122FCA724620FD8B72187FC5336C737D891D3CEF85F4F533B8DE2
SHA-512:	E1FA7F14F39C97AAA3104F3E13098626B5F7CFD665BA52DCB2312A329639AAF5083A9177E4686D11C4213E28ACC40E2C027988074B6CC13C5016D5C5E9EF897B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...w............" .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.659218747104705
Encrypted:	false
SSDEEP:	192:2E+tWthWvWf9BvVVWQ4mWxHD7DiqnajKswzGIAf:T+tWthWiNcGlGswzLAf
MD5:	721BAEA26A27134792C5CCC613F212B2
SHA1:	2A27DCD2436DF656A8264A949D9CE00EAB4E35E8
SHA-256:	5D9767D8CCA0FBFD5801BFF2E0C2ADDDD1BAAAA8175543625609ABCE1A9257BD
SHA-512:	9FD6058407AA95058ED2FDA9D391B7A35FA99395EC719B83C5116E91C9B448A6D853ECC731D0BDF448D1436382EECC1FA9101F73FA242D826CC13C4FD881D9BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...,OT..........." .........................................................0...........`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.739082809754283
Encrypted:	false
SSDEEP:	192:vdWthW8Wf9BvVVWQ4mWG2P+CjAWqnajKsNt:lWthWJNUP+CcWlGsNt
MD5:	B3F887142F40CB176B59E58458F8C46D
SHA1:	A05948ABA6F58EB99BBAC54FA3ED0338D40CBFAD
SHA-256:	8E015CDF2561450ED9A0773BE1159463163C19EAB2B6976155117D16C36519DA
SHA-512:	7B762319EC58E3FCB84B215AE142699B766FA9D5A26E1A727572EE6ED4F5D19C859EFB568C0268846B4AA5506422D6DD9B4854DA2C9B419BFEC754F547203F7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...X.j..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.601112204637961
Encrypted:	false
SSDEEP:	192:GFPWthW5Wf9BvVVWQ4mWc0ZD7DiqnajKswzczr:GFPWthWsNiGlGswzq
MD5:	89F35CB1212A1FD8FBE960795C92D6E8
SHA1:	061AE273A75324885DD098EE1FF4246A97E1E60C
SHA-256:	058EB7CE88C22D2FF7D3E61E6593CA4E3D6DF449F984BF251D9432665E1517D1
SHA-512:	F9E81F1FEAB1535128B16E9FF389BD3DAAAB8D1DABF64270F9E563BE9D370C023DE5D5306DD0DE6D27A5A099E7C073D17499442F058EC1D20B9D37F56BCFE6D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...ig............" .........................................................0......H.....`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14288
Entropy (8bit):	6.521808801015781
Encrypted:	false
SSDEEP:	192:/uUk1Jzb9cKcIzWthWzaWf9BvVVWQ4mWmrcLUVT/gqnajKsrCOV:/bk1JzBcKcIzWthWzXNz1IlGsrCOV
MD5:	0C933A4B3C2FCF1F805EDD849428C732
SHA1:	B8B19318DBB1D2B7D262527ABD1468D099DE3FB6
SHA-256:	A5B733E3DCE21AB62BD4010F151B3578C6F1246DA4A96D51AC60817865648DD3
SHA-512:	B25ED54345A5B14E06AA9DADD07B465C14C23225023D7225E04FBD8A439E184A7D43AB40DF80E3F8A3C0F2D5C7A79B402DDC6B9093D0D798E612F4406284E39D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....U..........." .........................................................0......Y.....`A........................................p................ ...................!..............p............................................................................rdata..4...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.671157737548847
Encrypted:	false
SSDEEP:	192:7oDfIeVWthWZWf9BvVVWQ4mWaHvP+CjAWqnajKsNZ:7oDfIeVWthWMNVP+CcWlGsNZ
MD5:	7E8B61D27A9D04E28D4DAE0BFA0902ED
SHA1:	861A7B31022915F26FB49C79AC357C65782C9F4B
SHA-256:	1EF06C600C451E66E744B2CA356B7F4B7B88BA2F52EC7795858D21525848AC8C
SHA-512:	1C5B35026937B45BEB76CB8D79334A306342C57A8E36CC15D633458582FC8F7D9AB70ACE7A92144288C6C017F33ECFC20477A04432619B40A21C9CDA8D249F6D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......N.....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.599056003106114
Encrypted:	false
SSDEEP:	192:gR7WthWTVWf9BvVVWQ4mWg2a5P+CjAWqnajKsNQbWl:gVWthWkN/P+CcWlGsNMg
MD5:	8D12FFD920314B71F2C32614CC124FEC
SHA1:	251A98F2C75C2E25FFD0580F90657A3EA7895F30
SHA-256:	E63550608DD58040304EA85367E9E0722038BA8E7DC7BF9D91C4D84F0EC65887
SHA-512:	5084C739D7DE465A9A78BCDBB8A3BD063B84A68DCFD3C9EF1BFA224C1CC06580E2A2523FD4696CFC48E9FD068A2C44DBC794DD9BDB43DC74B4E854C82ECD3EA5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....X4.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.602527553095181
Encrypted:	false
SSDEEP:	192:zGeVfcWthW+Wf9BvVVWQ4mWMiSID7DiqnajKswz5g:zGeVfcWthWjN6SIGlGswza
MD5:	9FA3FC24186D912B0694A572847D6D74
SHA1:	93184E00CBDDACAB7F2AD78447D0EAC1B764114D
SHA-256:	91508AB353B90B30FF2551020E9755D7AB0E860308F16C2F6417DFB2E9A75014
SHA-512:	95AD31C9082F57EA57F5B4C605331FCAD62735A1862AFB01EF8A67FEA4E450154C1AE0C411CF3AC5B9CD35741F8100409CC1910F69C1B2D807D252389812F594
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....P..........." .........................................................0.......`....`A........................................p................ ...................!..............p............................................................................rdata..P...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.6806369134652055
Encrypted:	false
SSDEEP:	192:qyMv0WthWPWf9BvVVWQ4mWIv/r+YVqnajKsSF:qyMv0WthWCNBfVlGsSF
MD5:	C9CBAD5632D4D42A1BC25CCFA8833601
SHA1:	09F37353A89F1BFE49F7508559DA2922B8EFEB05
SHA-256:	F3A7A9C98EBE915B1B57C16E27FFFD4DDF31A82F0F21C06FE292878E48F5883E
SHA-512:	2412E0AFFDC6DB069DE7BD9666B7BAA1CD76AA8D976C9649A4C2F1FFCE27F8269C9B02DA5FD486EC86B54231B1A5EBF6A1C72790815B7C253FEE1F211086892F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....E.=.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..,...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13776
Entropy (8bit):	6.573983778839785
Encrypted:	false
SSDEEP:	384:miwidv3V0dfpkXc0vVauzIWthWLN3fVlGsStY:nHdv3VqpkXc0vVaKbiYlY
MD5:	4CCDE2D1681217E282996E27F3D9ED2E
SHA1:	8EDA134B0294ED35E4BBAC4911DA620301A3F34D
SHA-256:	D6708D1254ED88A948871771D6D1296945E1AA3AEB7E33E16CC378F396C61045
SHA-512:	93FE6AE9A947AC88CC5ED78996E555700340E110D12B2651F11956DB7CEE66322C269717D31FCCB31744F4C572A455B156B368F08B70EDA9EFFEC6DE01DBAB23
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....k,..........." .........................................................0......3.....`A........................................p...X............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.7137872023984055
Encrypted:	false
SSDEEP:	192:TtZ3KjWthWzWf9BvVVWQ4mWXU0P+CjAWqnajKsN2v:TtZ3KjWthWeNwP+CcWlGsNa
MD5:	E86CFC5E1147C25972A5EEFED7BE989F
SHA1:	0075091C0B1F2809393C5B8B5921586BDD389B29
SHA-256:	72C639D1AFDA32A65143BCBE016FE5D8B46D17924F5F5190EB04EFE954C1199A
SHA-512:	EA58A8D5AA587B7F5BDE74B4D394921902412617100ED161A7E0BEF6B3C91C5DAE657065EA7805A152DD76992997017E070F5415EF120812B0D61A401AA8C110
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...jN/..........." .........................................................0............`A........................................p...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12768
Entropy (8bit):	6.614330511483598
Encrypted:	false
SSDEEP:	192:vgdKIMFYJWthW2Wf9BvVVWQ4SW2zZ7uUgxfzfqnaj0OGWh:0hJWthW7NBzIrloYh
MD5:	206ADCB409A1C9A026F7AFDFC2933202
SHA1:	BB67E1232A536A4D1AE63370BD1A9B5431335E77
SHA-256:	76D8E4ED946DEEFEEFA0D0012C276F0B61F3D1C84AF00533F4931546CBB2F99E
SHA-512:	727AA0C4CD1A0B7E2AFFDCED5DA3A0E898E9BAE3C731FF804406AD13864CEE2B27E5BAAC653BAB9A0D2D961489915D4FCAD18557D4383ECB0A066902276955A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....~y..........." .........................................................0............`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.704366348384627
Encrypted:	false
SSDEEP:	192:Ha2WthWKOWf9BvVVWQ4mWNOrVT/gqnajKsrCkb:Ha2WthWKTNz1IlGsrCo
MD5:	91A2AE3C4EB79CF748E15A58108409AD
SHA1:	D402B9DF99723EA26A141BFC640D78EAF0B0111B
SHA-256:	B0EDA99EABD32FEFECC478FD9FE7439A3F646A864FDAB4EC3C1F18574B5F8B34
SHA-512:	8527AF610C1E2101B6F336A142B1A85AC9C19BB3AF4AD4A245CFB6FD602DC185DA0F7803358067099475102F3A8F10A834DC75B56D3E6DED2ED833C00AD217ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....%j.........." .........................................................0......\|B....`A........................................p...P............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11728
Entropy (8bit):	6.623077637622405
Encrypted:	false
SSDEEP:	192:jWthWYWf9BvVVWQ4mWd8l1P+CjAWqnajKsNeCw:jWthW9NnP+CcWlGsNex
MD5:	1E4C4C8E643DE249401E954488744997
SHA1:	DB1C4C0FC907100F204B21474E8CD2DB0135BC61
SHA-256:	F28A8FE2CD7E8E00B6D2EC273C16DB6E6EEA9B6B16F7F69887154B6228AF981E
SHA-512:	EF8411FD321C0E363C2E5742312CC566E616D4B0A65EFF4FB6F1B22FDBEA3410E1D75B99E889939FF70AD4629C84CEDC88F6794896428C5F0355143443FDC3A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....R..........." .........................................................0............`A........................................p...<............ ...................!..............p............................................................................rdata..p...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.643812426159955
Encrypted:	false
SSDEEP:	192:fSWthWvWf9BvVVWQ4mWFl5P+CjAWqnajKsNifl:aWthWiN+5P+CcWlGsNiN
MD5:	FA770BCD70208A479BDE8086D02C22DA
SHA1:	28EE5F3CE3732A55CA60AEE781212F117C6F3B26
SHA-256:	E677497C1BAEFFFB33A17D22A99B76B7FA7AE7A0C84E12FDA27D9BE5C3D104CF
SHA-512:	F8D81E350CEBDBA5AFB579A072BAD7986691E9F3D4C9FEBCA8756B807301782EE6EB5BA16B045CFA29B6E4F4696E0554C718D36D4E64431F46D1E4B1F42DC2B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................" .........................................................0......l.....`A........................................P................ ...................!..............p............................................................................rdata..@...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15824
Entropy (8bit):	6.438848882089563
Encrypted:	false
SSDEEP:	192:yjQ/w8u4cyNWthWYWf9BvVVWQ4mWhu1BVT/gqnajKsrC74m:8yNWthW9Np1IlGsrCEm
MD5:	4EC4790281017E616AF632DA1DC624E1
SHA1:	342B15C5D3E34AB4AC0B9904B95D0D5B074447B7
SHA-256:	5CF5BBB861608131B5F560CBF34A3292C80886B7C75357ACC779E0BF98E16639
SHA-512:	80C4E20D37EFF29C7577B2D0ED67539A9C2C228EDB48AB05D72648A6ED38F5FF537715C130342BEB0E3EF16EB11179B9B484303354A026BDA3A86D5414D24E69
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....P............" .........................................................@............`A........................................P................0...................!..............p............................................................................rdata..>...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.6061629057490245
Encrypted:	false
SSDEEP:	192:vWOPWthWAWf9BvVVWQ4mWWbgftmP+CjAWqnajKsNURPblh:BWthWFN+f8P+CcWlGsNURzv
MD5:	7A859E91FDCF78A584AC93AA85371BC9
SHA1:	1FA9D9CAD7CC26808E697373C1F5F32AAF59D6B7
SHA-256:	B7EE468F5B6C650DADA7DB3AD9E115A0E97135B3DF095C3220DFD22BA277B607
SHA-512:	A368F21ECA765AFCA86E03D59CF953500770F4A5BFF8B86B2AC53F1B5174C627E061CE9A1F781DC56506774E0D0B09725E9698D4DC2D3A59E93DA7EF3D900887
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...t............." .........................................................0......H.....`A........................................P..."............ ...................!..............p............................................................................rdata..r...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13776
Entropy (8bit):	6.65347762698107
Encrypted:	false
SSDEEP:	192:WxSnWlC0i5ClWthWTWf9BvVVWQ4mW+hkKVT/gqnajKsrCw/:WxSnWm5ClWthW+NkK1IlGsrCY
MD5:	972544ADE7E32BFDEB28B39BC734CDEE
SHA1:	87816F4AFABBDEC0EC2CFEB417748398505C5AA9
SHA-256:	7102F8D9D0F3F689129D7FE071B234077FBA4DD3687071D1E2AEAA137B123F86
SHA-512:	5E1131B405E0C7A255B1C51073AFF99E2D5C0D28FD3E55CABC04D463758A575A954008EA1BA5B4E2B345B49AF448B93AD21DFC4A01573B3CB6E7256D9ECCEEF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...1............" .........................................................0......':....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.58394079658593
Encrypted:	false
SSDEEP:	192:YFY17aFBRQWthWIWf9BvVVWQ4mWHhOP+CjAWqnajKsNngJ:YQtWthWNNdP+CcWlGsNI
MD5:	8906279245F7385B189A6B0B67DF2D7C
SHA1:	FCF03D9043A2DAAFE8E28DEE0B130513677227E4
SHA-256:	F5183B8D7462C01031992267FE85680AB9C5B279BEDC0B25AB219F7C2184766F
SHA-512:	67CAC89AE58CC715976107F3BDF279B1E78945AFD07E6F657E076D78E92EE1A98E3E7B8FEAE295AF5CE35E00C804F3F53A890895BADB1EED32377D85C21672B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0.......l....`A........................................P................ ...................!..............p............................................................................rdata..f...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.696904963591775
Encrypted:	false
SSDEEP:	192:m8qWthWLWf9BvVVWQ4WWLXlyBZr+YVqnajKsS1:mlWthWWN0uZfVlGsS1
MD5:	DD8176E132EEDEA3322443046AC35CA2
SHA1:	D13587C7CC52B2C6FBCAA548C8ED2C771A260769
SHA-256:	2EB96422375F1A7B687115B132A4005D2E7D3D5DC091FB0EB22A6471E712848E
SHA-512:	77CB8C44C8CC8DD29997FBA4424407579AC91176482DB3CF7BC37E1F9F6AA4C4F5BA14862D2F3A9C05D1FDD7CA5A043B5F566BD0E9A9E1ED837DA9C11803B253
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...r..[.........." .........................................................0.......P....`A........................................P...e............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	6.216554714002396
Encrypted:	false
SSDEEP:	384:rQM4Oe59Ckb1hgmLRWthW0N0JBJ1IlGsrC5W:sMq59Bb1jYNABHJc
MD5:	A6A3D6D11D623E16866F38185853FACD
SHA1:	FBEADD1E9016908ECCE5753DE1D435D6FCF3D0B5
SHA-256:	A768339F0B03674735404248A039EC8591FCBA6FF61A3C6812414537BADD23B0
SHA-512:	ABBF32CEB35E5EC6C1562F9F3B2652B96B7DBD97BFC08D918F987C0EC0503E8390DD697476B2A2389F0172CD8CF16029FD2EC5F32A9BA3688BF2EBEEFB081B2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........,...............................................P............`A........................................P....%...........@...............0...!..............p............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64464
Entropy (8bit):	5.537611266681503
Encrypted:	false
SSDEEP:	1536:2PMeDe5c4bFe2JyhcvxXWpD7d3334BkZn+Ppzh:2DDe5c4bFe2JyhcvxXWpD7d3334BkZnU
MD5:	D76E7AAECB3D1CA9948C31BDAE52EB9D
SHA1:	142A2BB0084FAA2A25D0028846921545F09D9AE9
SHA-256:	785C49FD9F99C6EB636D78887AA186233E9304921DD835DEE8F72E2609FF65C4
SHA-512:	52DA403286659CF201C72FA0AB3C506ADE86C7E2FEF679F35876A5CEC4AEE97AFBC5BB13A259C51EFB8706F6AE7F5A6A3800176B89F424B6A4E9F3D5B8289620
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....{............" ......................................................................`A........................................P....................................!..............p............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12752
Entropy (8bit):	6.604643094751227
Encrypted:	false
SSDEEP:	192:uFdyqjd7NWthWxWf9BvVVWQ4mW+JZD7DiqnajKswzR1:YQsWthWkNfZGlGswzR1
MD5:	074B81A625FB68159431BB556D28FAB5
SHA1:	20F8EAD66D548CFA861BC366BB1250CED165BE24
SHA-256:	3AF38920E767BD9EBC08F88EAF2D08C748A267C7EC60EAB41C49B3F282A4CF65
SHA-512:	36388C3EFFA0D94CF626DECAA1DA427801CC5607A2106ABDADF92252C6F6FD2CE5BF0802F5D0A4245A1FFDB4481464C99D60510CF95E83EBAF17BD3D6ACBC3DC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....u..........." .........................................................0............`A........................................P...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16336
Entropy (8bit):	6.449023660091811
Encrypted:	false
SSDEEP:	192:eUW9MPrpJhhf4AN5/KihWthWBWf9BvVVWQ4mWRXwsD7DiqnajKswzK:eUZr7HWthWUNkGlGswzK
MD5:	F1A23C251FCBB7041496352EC9BCFFBE
SHA1:	BE4A00642EC82465BC7B3D0CC07D4E8DF72094E8
SHA-256:	D899C2F061952B3B97AB9CDBCA2450290B0F005909DDD243ED0F4C511D32C198
SHA-512:	31F8C5CD3B6E153073E2E2EDF0CA8072D0F787784F1611A57219349C1D57D6798A3ADBD6942B0F16CEF781634DD8691A5EC0B506DF21B24CB70AEE5523A03FD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....h.y.........." .........................................................@............`A........................................P...4............0...................!..............p............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17872
Entropy (8bit):	6.3934828478655685
Encrypted:	false
SSDEEP:	192:hA2uWYFxEpahDWthWDWf9BvVVWQ4mWR3ir+YVqnajKsSO:hIFVhDWthWONlfVlGsSO
MD5:	55B2EB7F17F82B2096E94BCA9D2DB901
SHA1:	44D85F1B1134EE7A609165E9C142188C0F0B17E0
SHA-256:	F9D3F380023A4C45E74170FE69B32BCA506EE1E1FBE670D965D5B50C616DA0CB
SHA-512:	0CF0770F5965A83F546253DECFA967D8F85C340B5F6EA220D3CAA14245F3CDB37C53BF8D3DA6C35297B22A3FA88E7621202634F6B3649D7D9C166A221D3456A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......w.........." ......... ...............................................@......>>....`A........................................P...a............0...............$...!..............p............................................................................rdata..............................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18384
Entropy (8bit):	6.279474608881223
Encrypted:	false
SSDEEP:	384:jvEvevdv8vPozmVx0C5yguNvZ5VQgx3SbwA7yMVIkFGlPWthWXNjqujGlGswz7:2ozmT5yguNvZ5VQgx3SbwA71IkFFaJft
MD5:	9B79965F06FD756A5EFDE11E8D373108
SHA1:	3B9DE8BF6B912F19F7742AD34A875CBE2B5FFA50
SHA-256:	1A916C0DB285DEB02C0B9DF4D08DAD5EA95700A6A812EA067BD637A91101A9F6
SHA-512:	7D4155C00D65C3554E90575178A80D20DC7C80D543C4B5C4C3F508F0811482515638FE513E291B82F958B4D7A63C9876BE4E368557B07FF062961197ED4286FB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...$............" ........."...............................................@............`A........................................P................0...............&...!..............p............................................................................rdata../...........................@..@.rsrc........0......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14288
Entropy (8bit):	6.547753630184197
Encrypted:	false
SSDEEP:	192:ENDCWthWHWf9BvVVWQ4mWG5xqcVT/gqnajKsrC/V:TWthW6N/xqc1IlGsrC/V
MD5:	1D48A3189A55B632798F0E859628B0FB
SHA1:	61569A8E4F37ADC353986D83EFC90DC043CDC673
SHA-256:	B56BC94E8539603DD2F0FEA2F25EFD17966315067442507DB4BFFAFCBC2955B0
SHA-512:	47F329102B703BFBB1EBAEB5203D1C8404A0C912019193C93D150A95BB0C5BA8DC101AC56D3283285F9F91239FC64A66A5357AFE428A919B0BE7194BADA1F64F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...E............" .........................................................0......f.....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.686357863452704
Encrypted:	false
SSDEEP:	192:ZjfHQdufWthWCWf9BvVVWQ4mWMlUteSP+CjAWqnajKsN0c:ZfZWthW/Nd4P+CcWlGsN0c
MD5:	DBC27D384679916BA76316FB5E972EA6
SHA1:	FB9F021F2220C852F6FF4EA94E8577368F0616A4
SHA-256:	DD14133ADF5C534539298422F6C4B52739F80ACA8C5A85CA8C966DEA9964CEB1
SHA-512:	CC0D8C56749CCB9D007B6D3F5C4A8F1D4E368BB81446EBCD7CC7B40399BBD56D0ACABA588CA172ECB7472A8CBDDBD4C366FFA38094A832F6D7E343B813BA565E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....@n#.........." .........................................................0............`A........................................P...^............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\base_library.zip

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332263
Entropy (8bit):	5.5864676354018465
Encrypted:	false
SSDEEP:	12288:uttcY+bStOmgRF1+fYNXPh26UZWAzCu7joqYnhjHgkVHdmmPnHz1dG6sF7aYceM:uttcY+UHCiCAd+cqHdmmPHzvwaYceM
MD5:	630153AC2B37B16B8C5B0DBB69A3B9D6
SHA1:	F901CD701FE081489B45D18157B4A15C83943D9D
SHA-256:	EC4E6B8E9F6F1F4B525AF72D3A6827807C7A81978CB03DB5767028EBEA283BE2
SHA-512:	7E3A434C8DF80D32E66036D831CBD6661641C0898BD0838A07038B460261BF25B72A626DEF06D0FAA692CAF64412CA699B1FA7A848FE9D969756E097CBA39E41
Malicious:	false
Preview:	PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI23522\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290282
Entropy (8bit):	6.048183244201235
Encrypted:	false
SSDEEP:	6144:QW1H/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5Np:QWN/TRJLWURrI55MWavdF0L
MD5:	302B49C5F476C0AE35571430BB2E4AA0
SHA1:	35A7837A3F1B960807BF46B1C95EC22792262846
SHA-256:	CF9D37FA81407AFE11DCC0D70FE602561422AA2344708C324E4504DB8C6C5748
SHA-512:	1345AF52984B570B1FF223032575FEB36CDFB4F38E75E0BD3B998BC46E9C646F7AC5C583D23A70460219299B9C04875EF672BF5A0D614618731DF9B7A5637D0A
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI23522\charset_normalizer\md.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.674392865869017
Encrypted:	false
SSDEEP:	96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
MD5:	D9E0217A89D9B9D1D778F7E197E0C191
SHA1:	EC692661FCC0B89E0C3BDE1773A6168D285B4F0D
SHA-256:	ECF12E2C0A00C0ED4E2343EA956D78EED55E5A36BA49773633B2DFE7B04335C0
SHA-512:	3B788AC88C1F2D682C1721C61D223A529697C7E43280686B914467B3B39E7D6DEBAFF4C0E2F42E9DDDB28B522F37CB5A3011E91C66D911609C63509F9228133D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d....jAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	5.917175475547778
Encrypted:	false
SSDEEP:	3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
MD5:	BF9A9DA1CF3C98346002648C3EAE6DCF
SHA1:	DB16C09FDC1722631A7A9C465BFE173D94EB5D8B
SHA-256:	4107B1D6F11D842074A9F21323290BBE97E8EED4AA778FBC348EE09CC4FA4637
SHA-512:	7371407D12E632FC8FB031393838D36E6A1FE1E978CED36FF750D84E183CDE6DD20F75074F4597742C9F8D6F87AF12794C589D596A81B920C6C62EE2BA2E5654
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d....jAe.........." ...%.:...........<.......................................0............`.........................................@...d.......................(............ ......P...................................@............P...............................text....8.......:.................. ..`.rdata...W...P...X...>..............@..@.data...8=.......0..................@....pdata..(...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5292
Entropy (8bit):	5.115440205505611
Encrypted:	false
SSDEEP:	96:DxapqZink/QIHQIyzQIZQILuQIR8vtklGovxNx6sWwCvCCcTKvIrrg9BMM6VwDjz:sJnkoBs/sqLz8cTKvIrrUiM6VwDjyeWs
MD5:	137D13F917D94C83137A0FA5AE12B467
SHA1:	01E93402C225BF2A4EE59F9A06F8062CB5E4801E
SHA-256:	36738E6971D2F20DB78433185A0EF7912A48544AA6FF7006505A7DC785158859
SHA-512:	1B22CBC6E22FA5E2BD5CC4A370443A342D00E7DD53330A4000E9A680DE80262BCA7188764E3568944D01025188291602AC8C53C971630984FBD9FA7D75AAB124
Malicious:	false
Preview:	Metadata-Version: 2.1..Name: cryptography..Version: 41.0.7..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15334
Entropy (8bit):	5.552806309785179
Encrypted:	false
SSDEEP:	384:3X62U/ZfaigdSwJN5i6s7B0Ppzx6uvndLE4:3NUxfzgFthE4
MD5:	D88787EC6163B4F45579EA7CF7F56044
SHA1:	B241754AF16F5B2523DE1D07520DADB5ABA559BA
SHA-256:	E5265DE4206BAB1FB0C96212067AA1EB479C85AB0495B915938DDB365B0C948D
SHA-512:	F4F1C213458AC42A3417A870F7C6D2A125950F588C76F8A83D605242ABBDBCC2CBE70CA49A700710AA23AC143F2702963DEA48043C5CA86FBF0D3CE07126C696
Malicious:	false
Preview:	cryptography-41.0.7.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-41.0.7.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-41.0.7.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-41.0.7.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-41.0.7.dist-info/METADATA,sha256=NnOOaXHS8g23hDMYWg73kSpIVEqm_3AGUFp9x4UViFk,5292..cryptography-41.0.7.dist-info/RECORD,,..cryptography-41.0.7.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-41.0.7.dist-info/WHEEL,sha256=-EX5DQzNGQEoyL99Q-0P0-D-CXbfqafenaAeiSQ_Ufk,100..cryptography-41.0.7.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=uPXMbbcptt7EzZ_jllGRx0pVdMn-NBsAM4L74hOv-b0,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/_

C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.0203365408149025
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlbY3KgP+tkKc/SKQLn:RtBMwlVCxWKxDQLn
MD5:	4B432A99682DE414B29A683A3546B69F
SHA1:	F59C5016889EE5E9F62D09B22AEFBC2211A56C93
SHA-256:	F845F90D0CCD190128C8BF7D43ED0FD3E0FE0976DFA9A7DE9DA01E89243F51F9
SHA-512:	CBBF10E19B6F4072C416EA95D7AE259B9C5A1B89068B7B6660B7C637D6F2437AEA8D8202A2E26A0BEC36DAECD8BBB6B59016FC2DDEB13C545F0868B3E15479CA
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp37-abi3-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography-41.0.7.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.2389012566026314
Encrypted:	false
SSDEEP:	3:cOv:Nv
MD5:	E7274BD06FF93210298E7117D11EA631
SHA1:	7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
SHA-256:	28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
SHA-512:	AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
Malicious:	false
Preview:	cryptography.

C:\Users\user\AppData\Local\Temp\_MEI23522\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6673920
Entropy (8bit):	6.582002531606852
Encrypted:	false
SSDEEP:	98304:EzN+T+xtLlk0PPMAiGoTzeDy3x8lGBlWi9Nk:E5Y6Jk0PPMtfTzp3x8c
MD5:	486085AAC7BB246A173CEEA0879230AF
SHA1:	EF1095843B2A9C6D8285C7D9E8E334A9CE812FAE
SHA-256:	C3964FC08E4CA8BC193F131DEF6CC4B4724B18073AA0E12FED8B87C2E627DC83
SHA-512:	8A56774A08DA0AB9DD561D21FEBEEBC23A5DEA6F63D5638EA1B608CD923B857DF1F096262865E6EBD56B13EFD3BBA8D714FFDCE8316293229974532C49136460
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......QN.../.../.../...W(../......./......./......./......./...R.../...Z.../..^W.../.../...-../...",......./.../.../......./......./..Rich./..........PE..d...M7ee.........." ...&..M..........L...................................... f...........`......................................... .a.p.....a.\|............Pb..............Pe.p...p.[.T.....................[.(...0.[.@............0M..............................text.....M.......M................. ..`.rdata.......0M.......M.............@..@.data........0a.......a.............@....pdata.......Pb.......b.............@..@.reloc..p....Pe.......e.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5191960
Entropy (8bit):	5.962142634441191
Encrypted:	false
SSDEEP:	98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
MD5:	E547CF6D296A88F5B1C352C116DF7C0C
SHA1:	CAFA14E0367F7C13AD140FD556F10F320A039783
SHA-256:	05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE
SHA-512:	9F42EDF04C7AF350A00FA4FDF92B8E2E6F47AB9D2D41491985B20CD0ADDE4F694253399F6A88F4BDD765C4F49792F25FB01E84EC03FD5D0BE8BB61773D77D74D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l......l...m..l...i..l...h..l...o..l..m.y.l...m...l...o..l...h.l...l..l......l...n..l.Rich.l.........PE..d......e.........." ...%..7..4......v.........................................O.......P...`.........................................P.H.0....kN.@.....N.\|.....K.d.....O../....N....P.C.8.............................C.@............`N..............................text.....7.......7................. ..`.rdata....... 7.......7.............@..@.data....n....K..<....J.............@....pdata..0.....K......4K.............@..@.idata...%...`N..&....N.............@..@.00cfg..u.....N.......N.............@..@.rsrc...\|.....N......0N.............@..@.reloc........N......8N.............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	787224
Entropy (8bit):	5.609561366841894
Encrypted:	false
SSDEEP:	12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
MD5:	19A2ABA25456181D5FB572D88AC0E73E
SHA1:	656CA8CDFC9C3A6379536E2027E93408851483DB
SHA-256:	2E9FBCD8F7FDC13A5179533239811456554F2B3AA2FB10E1B17BE0DF81C79006
SHA-512:	DF17DC8A882363A6C5A1B78BA3CF448437D1118CCC4A6275CC7681551B13C1A4E0F94E30FFB94C3530B688B62BFF1C03E57C2C185A7DF2BF3E5737A06E114337
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>:V.PiV.PiV.Pi_..iX.PiC.QhT.Pi..QhT.PiC.UhZ.PiC.Th^.PiC.ShR.PillQhU.PiV.QiH.PillThf.PillPhW.Pill.iW.PillRhW.PiRichV.Pi................PE..d......e.........." ...%...........K........................................ ............`..........................................g...Q..............s.......@M......./......`.......8...........................`...@............p...............................text...D)......................... ..`.rdata..Hy...@...z..................@..@.data....N.......H..................@....pdata...V.......X..................@..@.idata...c...p...d...H..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..4...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy.libs\libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38168576
Entropy (8bit):	6.305082264196138
Encrypted:	false
SSDEEP:	196608:O99XmuJ2l6d6iET5BH6ZCy1iMq5NV2OzPWJAt+bOzPWVa+llOzPWIqzfr2V9EwS6:0OzPW5OzPW5OzPWIDMD9K6LSn1ZP
MD5:	5E46C3D334C90C3029EB6AE2A3FE58F2
SHA1:	AD3D806F720289CCB90CE8BFD0DA49FA99E7777B
SHA-256:	57B87772BF676B5C2D718C79DDDC9F039D79EC3319FEE1398CC305ADFF7B69E5
SHA-512:	4BD29D19B619076A64A928F3871EDCCE8416BCF100C1AA1250932479D6536D9497F2F9A2668C90B3479D0D4AB4234FFA06F81BC6B107FAD1BE5097FA2B60AB28
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......e.D........& ...$.....x......P.........{..............................`........F...`... ......................................P..Xe...................p...$...............V.............................(...................\|...P............................text...............................`..`.data....,..........................@.`..rdata...L... ...N..................@.p@.pdata...$...p...&...X..............@.0@.xdata..p#.......$...~..............@.0@.bss.....~............................`..edata..Xe...P...f..................@.0@.idata..............................@.0..CRT....`............"..............@.@..tls.................$..............@.@..reloc...V.......X...&..............@.0B/4...... ....`.......~..............@.PB/19.....Y....p......................@..B/31......_...P...`...`..............@..B/45.................................@..B/57.....

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\core\_multiarray_tests.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	66048
Entropy (8bit):	6.0029845891810085
Encrypted:	false
SSDEEP:	768:3p/PUg+VQrec6dx6gXZtu5sx0wtvnSPmFzO+ooK83Ngu6nSO:3pUdVQreR68/uItvSPmF6+ojcv6nSO
MD5:	92C51DAF855C25EB229F15CB61F39B5D
SHA1:	2732021A3D1A9EFE52C2B2EC993D3DA3EFBE6246
SHA-256:	95BC29ED6DC02BF8AA3AADD078B9812AAE5E4E8A663778114D20827E9F9C3D8E
SHA-512:	F168E553CA05AE9458A9DC77F8312A3FC9192534C339B20668B461E8975729399CE248693E3CE411AF7A2A88BDFFAF6438175619EBDD27C6AA5AAA1B582E5911
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........T..............................................@............`.........................................0........................ ...............0......P...............................p...8............... ............................text.............................. .P`.rdata..29.......:..................@.P@.data...............................@.P..pdata....... ......................@.0@.reloc.......0......................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\core\_multiarray_umath.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2842624
Entropy (8bit):	6.636429648896842
Encrypted:	false
SSDEEP:	49152:H/Yfw6/aTE+CyxakxYgfPpmh0By/TDwY6uSOuzLXRB06D:H/Aa/X2/TaOuzL
MD5:	B5322718A11C7DB4C1A1486F1A162ADB
SHA1:	4C77B34D686C197C4790D4B79D70EE59CFA41460
SHA-256:	5EF0804BE17E6ACCF19332DFACB88A89AB24953A14A42D289B2983C55CCE7009
SHA-512:	17D112DD8935CCB2F3FCFD15236A636C59F0E92A4EF861862E06EFD3A2F4EBBBC45533270DFE5B1F65FFF0FD066D19B57240385011F3BB5E63CFF0A06A994F19
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...... ........... .......................................-.......,...`.........................................PX'.t....X'.,.............+.(............`-.\|$....%............................. .%.8............. ..............................text...h. ....... ................. .P`.rdata........ ....... .............@.P@.data...P"....'.. ....'.............@.P..pdata..(.....+.......).............@.0@.reloc..\|$...`-..&...:+.............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\fft\_pocketfft_internal.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	110080
Entropy (8bit):	6.157829267971521
Encrypted:	false
SSDEEP:	3072:1J7u06kUyyTZDXZhTZdjrozKDaGE2A8wRdpdCqgeh1m:1J7uYkVDXHVdozKe521wRFh3
MD5:	90D30098D86837386A666D6E6388006E
SHA1:	BE1244955C42E8ACEDFF587DB9C9D43A0FC88874
SHA-256:	1B68264914063E2DF22ED04668F937BC43EC58D756091E9D061FDE3D4915CF23
SHA-512:	D0CFEA6E2349B6124939B2CED72C4077FAA3F4525A6A490577C98437EBED1E6A36D26A1552CA1680639EB87E71388FC424C00366720A62742A36A35A8223A782
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....\|................................................................`.............................................x.......................................<.....................................8............................................text...X{.......\|.................. .P`.rdata..p........ ..................@.P@.data...............................@.P..pdata..............................@.0@.reloc..<...........................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\linalg\_umath_linalg.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	6.296943343498824
Encrypted:	false
SSDEEP:	1536:uEXFL7JoLGR94dIIpxFlJz+G6jlTJdaWM0BCQUIGBpdJHIGJQk5S7:ZFxhUxFlJz+njlTX7sIGBpDIfk5S7
MD5:	D536FCFF8E188E4C2239ED9DBC964084
SHA1:	050CFB86702D06DBC4E4ABF9D7A759978A42E8A9
SHA-256:	8F21B754C44B6CD04184E955654243CF05C011DE25E83578C1014B566BAA9D9B
SHA-512:	E9E9A81E246BBAF7C6F7F7D080889EB58EA158F7E12893F5A03A4A59B3662C3FBE1829B68A6AAE05E60ED5C22E09C555028310453F4004470EE5B1E26BCC5646
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....N...T.......R..............................................o!....`.............................................l...,........................................t...............................u..8............`..(............................text....M.......N.................. .P`.rdata...5...`...6...R..............@.P@.data...............................@.P..pdata..............................@.0@.reloc..............................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_bounded_integers.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	231936
Entropy (8bit):	6.465013607402119
Encrypted:	false
SSDEEP:	6144:4ibqI1hY1IQN7TBhPztGq6f+WGWHRtxyvJRWjwTk/TG:4ibqI1hIzWfpHHRpjw3
MD5:	D76245820BE06CFE77DB2B0FD9788F49
SHA1:	45689D2B013F97E95A8C1C2FA7DA399F818EC234
SHA-256:	176B0735F50BF071D9B007FD8B0E3E763663D8B02E3EFD1AE07BECB68A629EC4
SHA-512:	1ECE25120EEC6D97188D810F1D8DA00764449577DFF0F6DBE3199136BAFE96BF46C9E4810C4B8942574C4B1D987AAAFE3D547EC4B2488C0F4989B77AA98D7CA0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".................................................................(....`.........................................`e.. ....m..x...............P...............P....H...............................I..8............... ............................text............................... .P`.rdata..............................@.P@.data...8............t..............@.P..pdata..P............v..............@.0@.reloc..P...........................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_common.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	166400
Entropy (8bit):	6.16054841448225
Encrypted:	false
SSDEEP:	3072:4Eh3AzI0GZVlTesyp0k3itVoBzSunh/xoV:4E5UI0GZVNUKVyzSu3C
MD5:	66CF3F29BECCC6AD4EE3EE3B8B7AF98B
SHA1:	5338CA4140BB3C473D18092F6F0349E9D9DC8C56
SHA-256:	185F6666ED6854977B6439B00814B4A56247A309789DCEE29CA17E88DC4F5B87
SHA-512:	3E11C50436973B0EF3CD50DD4DE442DAABC2A0FFE440D49D21960383AB25ACC2467EA7AB78407D7E8387832FA185F581DD17EA81409B861ED816FD473F7652A5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........l......P.....................................................`..........................................p..`...@q..x...............`...................P`..............................p`..8............0.. ............................text............................... .P`.rdata...W...0...X..................@.P@.data................v..............@.P..pdata..`............~..............@.0@.reloc..............................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_generator.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	689152
Entropy (8bit):	6.32270721353156
Encrypted:	false
SSDEEP:	12288:aJg7dcXhfd8IE3hjy1IqidsQLRsfxU2exLmxHjwB:ai7uhfaFRBiqRsimxD2
MD5:	F954DC5B1A79106A8CB98A3B481A49C0
SHA1:	099D0498FF69982B1E69B8CA0B07820DB0D1343C
SHA-256:	BB1AEF8C19B81B5B044B5D47D683601EED2C60412D68C075F7AA9EAC55CCBDB0
SHA-512:	50C7DEAB5FEB29A24E29DF756152079A44E413E00E29C98EA9556A7F2C73E88C7CF4A25569F52141E56DB1CC887B9AA8DFB92949A74E086A9B6214997561FDA6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."..... ...`......P$...................................................`..........................................0.......9..................................h... ...............................@...8............0...............................text...X........ .................. .P`.rdata...$...0...&...$..............@.P@.data....0...`.......J..............@.P..pdata...............b..............@.0@.reloc..h...........................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_mt19937.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	6.1841804914562974
Encrypted:	false
SSDEEP:	1536:JIZlzNnw+v/wzqo5VJtnkzDQODdPRmdxlEhu8Ef2:gFNnjRoznkzDIqU8Ef2
MD5:	D6D11C2796AE40C950C7E25782999C7A
SHA1:	C82F75A0F2818C714021206DFA312999117BBF00
SHA-256:	E0856FDAB0D2B1FB64BA24E05B83ABDC31212C5C983E32C6B49D3911D97B2D78
SHA-512:	471610535C30206BCCDC11059E743E1870FF9A8969C6B5437D2478926699F8865044462540D6D2AB99DCA3E2ACA19A1A48B3C5BE00D0D0DCE62128E23B683611
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........h......0........................................`....../F....`.............................................`...0...x............@..l............P..\|...P...............................p...8............................................text.............................. .P`.rdata...X.......Z..................@.P@.data........0......................@.P..pdata..l....@......................@.0@.reloc..\|....P.......&..............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_pcg64.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	6.087600380435088
Encrypted:	false
SSDEEP:	1536:yAaRay9hKIybw+bt41HAURJQdsOJVxi0IW50Vcu/:yAqay3Kdw0t56450yu/
MD5:	C15EAF827584245FAA0E88B62A85D05D
SHA1:	129B7B9A060376D97BFB7328A403C3BD077E6138
SHA-256:	F56ADC692A97E4A6A3D391E04A1CB5A59343652407E2520C5CF79CB6173F0163
SHA-512:	0A239BF2364B3FB652747771F65BAE9485B1485DCC429D3EA7D45F81E4B322AA9D01304CF15E5CBE7ABB6BD876F73195F0A5AA16636D065B90EE8D792AE719C1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........t......................................................J&....`........................................../..\..../..x............`...............p......0#..............................P#..8............................................text...h........................... .P`.rdata...a.......b..................@.P@.data........P......................@.P..pdata.......`.......6..............@.0@.reloc.......p.......>..............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_philox.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	6.068724798266156
Encrypted:	false
SSDEEP:	1536:XUx34cosUUi6mHW3BYiRUqBkG7B5P6EsSuP:Xw34cIvHWG+nBXB5PNsSuP
MD5:	FDBF66153C13D319D1E7C9F129CF08E3
SHA1:	F8518A17644EF95E89F07C7B713C9B121E05B9C6
SHA-256:	0810150CCEAD60D2B3084333492019AE90A0F28FD82664C96966D9BDC83686F2
SHA-512:	308C228AA502EC2EEB1448E48C45EDD1520833851A1E7902D398E6ED4014F6CFE41345B3B5924711B7285D7E3B5181C848F5F821410FAE3AD9B4229E2B55F12F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........`......P........................................P......V.....`.........................................P...`.......x............0...............@..\|.......................................8............................................text............................... .P`.rdata...R.......T..................@.P@.data........ ......................@.P..pdata.......0......................@.0@.reloc..\|....@......................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\_sfc64.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	50688
Entropy (8bit):	5.851923736767711
Encrypted:	false
SSDEEP:	768:3N97lLxP9RgV508lRcuyAGYp6iyVqonQHsXaMoP9UrWEl+AMP:Lz1RgVTXy2cK9kWElyP
MD5:	ECEC79538AB9149FFBD3F326BBE4A638
SHA1:	655AE3B72CD0A52D11CF76EEB5FDC5098CEEE750
SHA-256:	EEC06C70418E3D410E55D47C2FA84F880480CBFB9A4ABF073F188AD2B483C1CB
SHA-512:	94C334124C4E6666D6A96448672B8B7EF37AF76C783ED82837792FB271745A3FABF8C9765EAC46AC31E58EE000B6327B14418024B027DA6DA9C51FF2282AA3DE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....x...J.......{..............................................L.....`.........................................p...\......x...............................p......................................8............................................text...Xv.......x.................. .P`.rdata...=.......>...\|..............@.P@.data...............................@.P..pdata..............................@.0@.reloc..p...........................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\bit_generator.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	160768
Entropy (8bit):	6.214539257343106
Encrypted:	false
SSDEEP:	3072:hPTECiv12+KX4IlhvHFucDJeX9bqz18x9C21FpMsDEV2+WarahR2+WarahTYqSyv:hPTECiv12+KIyJ/VeXhGY9RYV2+Waray
MD5:	0025817C31FE2CC158499B1175E2BA92
SHA1:	60A2127356D80333C403246FCBD2BF8B539D5FD6
SHA-256:	D746972E355DCE6131B67D8121AE3BF20191C4FFFE555FE994DEBA8C12FC8591
SHA-512:	2DB30BA60C5900214327191D0975ED24122BEC927AE559AC5B37B47BA41A4B91BAC05C85200BC1633902E9FBE27C46819BDF0860FBE26921D5B6DEE748919A10
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."................P...............................................d=....`.........................................@G..l....G..x....................................5...............................5..8............................................text............................... .P`.rdata..............................@.P@.data...h!...`.......R..............@.P..pdata...............f..............@.0@.reloc...............r..............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\numpy\random\mtrand.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	582656
Entropy (8bit):	6.2168844883747285
Encrypted:	false
SSDEEP:	6144:TkE7mm5J7UiJ8u1hLDlWPsq6p4S4gP4KBSkPSoHRSKrkSoSL7MSquASLSqSwSkSE:AE7JJ7p/P5q660XZ0X2beSn+yijwd
MD5:	1BE97B97C39BBE483D8A8863CDB5DD5E
SHA1:	281082C71F89FF79575B463D8C72F4F76640EE73
SHA-256:	8893E35F6545DE8718D435FC4FFE3583DB0D4EABB2EB087D951FF58A3BBAA7DD
SHA-512:	B6551D0563870F13FB391E65C879E4C69689014009F610C4D7648645409C66AB29505D6D2043D3F8FC63248B3D6AF72C7597F2874348BC038F6F2FEC4002E233
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........(...............................................@............`..................................................................................0......P...............................p...8...............x............................text............................... .P`.rdata..............................@.P@.data...(#..........................@.P..pdata..............................@.0@.reloc.......0......................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\psutil\_psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	5.90551713971002
Encrypted:	false
SSDEEP:	1536:ZhseNxkc7Xva0Y420G1UD+dS4gBeLmRy:Z1kcbi0Y42bUD+dS4oeiRy
MD5:	01F9D30DD889A3519E3CA93FE6EFEE70
SHA1:	EBF55ADBD8CD938C4C11D076203A3E54D995AEFF
SHA-256:	A66444A08A8B9CEAFA05DAEFEB32AA1E65C8009A3C480599F648FA52A20AFB7D
SHA-512:	76FED302D62BB38A39E0BF6C9038730E83B6AFFFA2F36E7A62B85770D4847EA6C688098061945509A1FDB799FB7F5C88699F94E7DA1934F88A9C3B6A433EE9EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`T..$5..$5..$5..-M3..5..v@..&5..v@..(5..v@..,5..v@.. 5...k..&5..oM..55..$5...5...@..45...@..%5...@_.%5...@..%5..Rich$5..........................PE..d.....~e.........." .........h..............................................@............`.........................................P...`.......@.... .......................0..(.......................................8............................................text............................... ..`.rdata..\|I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	199448
Entropy (8bit):	6.385263095268062
Encrypted:	false
SSDEEP:	3072:gP9/HQAYp/8IdzL37lqrEJesY7p7Ndrjt8HWcFwUT6ZIALhNn6:opFYp/vdzL3pqrEJ2xDrJ8DdT6A
MD5:	F179C9BDD86A2A218A5BF9F0F1CF6CD9
SHA1:	4544FB23D56CC76338E7F71F12F58C5FE89D0D76
SHA-256:	C42874E2CF034FB5034F0BE35F7592B8A96E8903218DA42E6650C504A85B37CC
SHA-512:	3464ECE5C6A0E95EF6136897B70A96C69E552D28BFEDD266F13EEC840E36EC2286A1FB8973B212317DE6FE3E93D7D7CC782EB6FC3D6A2A8F006B34F6443498DE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W,.6B..6B..6B..N..6B..IC..6B..IG..6B..IF..6B..IA..6B...C..6B..NC..6B..6C..6B...O..6B...B..6B......6B...@..6B.Rich.6B.........PE..d......e.........." ...%.............................................................)....`......................................... ...P...p............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata..D.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\python3.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68376
Entropy (8bit):	6.14896460878624
Encrypted:	false
SSDEEP:	768:LV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/u:LDmF61JFn+/OHZIAL0R7SyHxy
MD5:	6271A2FE61978CA93E60588B6B63DEB2
SHA1:	BE26455750789083865FE91E2B7A1BA1B457EFB8
SHA-256:	A59487EA2C8723277F4579067248836B216A801C2152EFB19AFEE4AC9785D6FB
SHA-512:	8C32BCB500A94FF47F5EF476AE65D3B677938EBEE26E80350F28604AAEE20B044A5D55442E94A11CCD9962F34D22610B932AC9D328197CF4D2FFBC7DF640EFBA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T...5e..5e..5e..m..5e..e..5e.....5e..g..5e.Rich.5e.........PE..d......e.........." ...%............................................................x.....`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\python312.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7009048
Entropy (8bit):	5.7826778751744685
Encrypted:	false
SSDEEP:	49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WF4:mooCcqKLHX+az2Ro8Kv7HDMiEB/
MD5:	550288A078DFFC3430C08DA888E70810
SHA1:	01B1D31F37FB3FD81D893CC5E4A258E976F5884F
SHA-256:	789A42AC160CEF98F8925CB347473EEEB4E70F5513242E7FABA5139BA06EDF2D
SHA-512:	7244432FC3716F7EF27630D4E8FBC8180A2542AA97A01D44DCA260AB43966DD8AC98B6023400B0478A4809AACE1A128F1F4D6E544F2E591A5B436FD4C8A9D723
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T..e...e...e...d...e.......e...`...e...a...e...f...e.......e..d...e...d...e..Bh.M.e..Be...e..B....e..Bg...e.Rich..e.........................PE..d......e.........." ...%.$)..ZB......]........................................k.....:.k...`...........................................O.d...toP......Pj.......`.dZ....j../...`j.pZ....3.T.....................I.(...P.3.@............@)..............................text....")......$)................. ..`.rdata...T'..@)..V'..().............@..@.data....?....P......~P.............@....pdata..dZ....`..\....`.............@..@PyRuntim.....@c......\b.............@....rsrc........Pj......^i.............@..@.reloc..pZ...`j..\...hi.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\pywin32_system32\pywintypes312.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	5.9953900911096785
Encrypted:	false
SSDEEP:	3072:Yuh2G0a2fYrFceQaVK756Y/r06trvoEKQAe7KL8KJKVKGajt4:Yuh2faiYrFceQaVfY/rxTBAe7KwKwVrE
MD5:	26D752C8896B324FFD12827A5E4B2808
SHA1:	447979FA03F78CB7210A4E4BA365085AB2F42C22
SHA-256:	BD33548DBDBB178873BE92901B282BAD9C6817E3EAC154CA50A666D5753FD7EC
SHA-512:	99C87AB9920E79A03169B29A2F838D568CA4D4056B54A67BC51CAF5C0FF5A4897ED02533BA504F884C6F983EBC400743E6AD52AC451821385B1E25C3B1EBCEE0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.$g..wg..wg..wn.[wk..w5..vc..w..5wf..w5..vs..w5..vo..w5..vd..ws..vf..w...ve..ws..vl..wg..w...w...vj..w...vf..w...vf..wRichg..w........PE..d......d.........." ................L........................................P............`......................................... u..`B......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\select.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30488
Entropy (8bit):	6.582548725691534
Encrypted:	false
SSDEEP:	384:b9yLTFInPLnIdHqp3DT90IZIAQGyHQIYiSy1pCQ273bAM+o/8E9VF0Nypyn4:6inzUHqN1rZIAQGo5YiSyvUrAMxkEjh
MD5:	8A273F518973801F3C63D92AD726EC03
SHA1:	069FC26B9BD0F6EA3F9B3821AD7C812FD94B021F
SHA-256:	AF358285A7450DE6E2E5E7FF074F964D6A257FB41D9EB750146E03C7DDA503CA
SHA-512:	7FEDAE0573ECB3946EDE7D0B809A98ACAD3D4C95D6C531A40E51A31BDB035BADC9F416D8AAA26463784FF2C5E7A0CC2C793D62B5FDB2B8E9FAD357F93D3A65F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..t.s.'.s.'.s.'..7'.s.'...&.s.'...&.s.'...&.s.'...&.s.'(.&.s.'.s.'Ps.'Y..&.s.'(.&.s.'(.&.s.'(.['.s.'(.&.s.'Rich.s.'........PE..d......e.........." ...%.....2.......................................................y....`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1500440
Entropy (8bit):	6.588676275246953
Encrypted:	false
SSDEEP:	24576:iTqtyGkxOc+wv05tP5kf82Hr/74YPF5o/P/gnAracr7/24UcypY7w0vpZUFv++b:hk0jwv4tP5kf8ar/74EF2/An4acrVUcc
MD5:	C1161C1CEC57C5FFF89D10B62A8E2C3A
SHA1:	C4F5DEA84A295EC3FF10307A0EA3BA8D150BE235
SHA-256:	D1FD3040ACDDF6551540C2BE6FF2E3738F7BD4DFD73F0E90A9400FF784DD15E6
SHA-512:	D545A6DC30F1D343EDF193972833C4C69498DC4EA67278C996426E092834CB6D814CE98E1636C485F9B1C47AD5C68D6F432E304CD93CEED0E1E14FEAF39B104A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......SJ...+...+...+...S...+...T...+...T...+...T...+...T...+..\S...+...+...+..-....+..-....+..-.n..+..-....+..Rich.+..................PE..d......e.........." ...%............................................................M7....`..........................................d...".............................../..........P...T...............................@...............@............................text...x........................... ..`.rdata..f...........................@..@.data....G.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1035728
Entropy (8bit):	6.630126944065657
Encrypted:	false
SSDEEP:	24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
MD5:	849959A003FA63C5A42AE87929FCD18B
SHA1:	D1B80B3265E31A2B5D8D7DA6183146BBD5FB791B
SHA-256:	6238CBFE9F57C142B75E153C399C478D492252FDA8CB40EE539C2DCB0F2EB232
SHA-512:	64958DABDB94D21B59254C2F074DB5D51E914DDBC8437452115DFF369B0C134E50462C3FDBBC14B6FA809A6EE19AB2FB83D654061601CC175CDDCB7D74778E09
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........of...5...5...5..5...5...5&..5...5...5...4...5...4...5...4...5...4...5...4..5...5...5...4...5Rich...5........PE..d.....$%.........." .....:..........0Z..............................................7^....`A................................................................. ...........!.............p........................... f..............................................text...09.......:.................. ..`.rdata..^....P.......>..............@..@.data....&..........................@....pdata....... ......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1137944
Entropy (8bit):	5.462202215180296
Encrypted:	false
SSDEEP:	12288:hrEHdcM6hbFCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciFt:hrEXYCjfk7bPNfv42BN6yzUiFt
MD5:	04F35D7EEC1F6B72BAB9DAF330FD0D6B
SHA1:	ECF0C25BA7ADF7624109E2720F2B5930CD2DBA65
SHA-256:	BE942308D99CC954931FE6F48ED8CC7A57891CCBE99AAE728121BCDA1FD929AB
SHA-512:	3DA405E4C1371F4B265E744229DCC149491A112A2B7EA8E518D5945F8C259CAD15583F25592B35EC8A344E43007AE00DA9673822635EE734D32664F65C9C8D9B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K..K..K..B.q.M..^..I..^..F..^..C..^..H..qE.H.....I..K.....qE.J..qE.J..qE..J..qE..J..RichK..........................PE..d......e.........." ...%.>..........`*.......................................p............`.........................................p...X............P.......@.........../...`......P^..T............................]..@............P..p............................text....=.......>.................. ..`.rdata..\....P.......B..............@..@.data...X.... ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.851293297484796
Encrypted:	false
SSDEEP:	3072:bPwB2zC1vwC3XetCf5RlRVFhLaNKPRyymoh5Lm9b0e:bIB2zkvwGXetCfDlRVlPRy85Lm9
MD5:	3A80FEA23A007B42CEF8E375FC73AD40
SHA1:	04319F7552EA968E2421C3936C3A9EE6F9CF30B2
SHA-256:	B70D69D25204381F19378E1BB35CC2B8C8430AA80A983F8D0E8E837050BB06EF
SHA-512:	A63BED03F05396B967858902E922B2FBFB4CF517712F91CFAA096FF0539CF300D6B9C659FFEE6BF11C28E79E23115FD6B9C0B1AA95DB1CBD4843487F060CCF40
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I^.f'..f'..f'......f'...&..f'...#..f'...$..f'.o.&..f'..."..f'...&..f'..f&..g'.o....f'.o.'..f'.o.%..f'.Rich.f'.................PE..d......d.........." .........................................................P............`..........................................................0..\....................@..$....v..T............................<..8............0..........@....................text...$........................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..$....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\win32\win32crypt.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	123904
Entropy (8bit):	5.966619585818369
Encrypted:	false
SSDEEP:	3072:07jbPA0SD9S3vrCqf93qMHxCjdLZn1Ya:07jtS9SfuCRCjFV
MD5:	47C91C74BB2C5CF696626AF04F3705AB
SHA1:	C086BC2825969756169FAB7DD2E560D360E1E09C
SHA-256:	F6EAD250FC2DE4330BD26079A44DED7F55172E05A70E28AD85D09E7881725155
SHA-512:	E6B6A4425B3E30CEA7BF8B09971FA0C84D6317B1A37BC1518266DC8D72C166099A8FC40A9B985300901BD921E444FF438FD30B814C1F1C6A051DF3471615C2BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U...U...U...\.v.S.......Q.......E.......].......V.....Q...A...R...U........\.....T.....T...RichU...........PE..d......d.........." ................(........................................ ............`..........................................o..................d.......................H....G..T............................H..8............................................text...~........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..............................@..@.rsrc...d...........................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI23522\win32\win32pdh.pyd

Download File

Process:	C:\Users\user\Desktop\0jNz7djbpp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.607776737873708
Encrypted:	false
SSDEEP:	384:qTtWWcU+d47NgCuVuA7dBm7BZ1CHrWBGwm3ReuuR+F1igomqhPGZGQvD3+VC5pEa:qM47+YedBm0WBgIuuGigahAF7+m2Ca
MD5:	1580EE4142FB1F90F00B9F5A3CA297EB
SHA1:	BC730100B6E8C85F709BCFB4FD7A81FB91ABF7D1
SHA-256:	BD3F16AFB19AF91B016AB3E9669CD845F70F7A4B7A2489A81F312F060B1FB020
SHA-512:	692C4A0595B715B14A53B41DD192AFB3058A85530975C0CAC673F3D70A2AA31FA66762FC7F453739B35971559F33E6CB20C62FC13C79796E43FF14A8728A26A1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d.wKd.wKd.wKm..Kb.wK6.vJ`.wKp.vJf.wK6.rJh.wK6.sJl.wK6.tJg.wK..vJa.wKd.vK<.wK..~Je.wK..wJe.wK..uJe.wKRichd.wK........PE..d......d.........." .....D...@.......@....................................................`.........................................@...P...............\............................p..T............................p..8............`...............................text....C.......D.................. ..`.rdata..X,...`.......H..............@..@.data...x............v..............@....pdata...............z..............@..@.rsrc...\...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.997015048064936
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0jNz7djbpp.exe
File size:	31'979'318 bytes
MD5:	2bfda47c91a80443539fb763dc2b6027
SHA1:	4ab34c3028dea6c636ed7ae2f94ec55cd8a78d55
SHA256:	151e75f3ed3003b63ecbee13741e788b519db99c5253f32a041f501f28688111
SHA512:	23443af6ceef03d2b131127e1c57a830e69cb2e9f03e0435d3bb0290b78dbdf90c307b752bb2b7d887ef3603448d2d211896aecbca2488f5c1f47fa6ff23b3de
SSDEEP:	786432:ypb6HUTLJE1QtIJ2j6+s7LWB75zupmS3ILn6e1zeCQVH:DHUTdQiIJ2qHWB75ipmSGJ
TLSH:	5467335AB35568B2E2DB423A923584AA26537CDC13B0CA5F43F932631BBF1738E35135
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?.......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?................

File Icon


Icon Hash:	0fd88dc89ea7861b

Static PE Info

General

Entrypoint:	0x14000c1f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x65E7BB02 [Wed Mar 6 00:38:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	1af6c885af093afc55142c2f1761dbe8

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F23086C34BCh
dec eax
add esp, 28h
jmp 00007F23086C30CFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F23086C3A34h
test eax, eax
je 00007F23086C3273h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F23086C3257h
dec eax
cmp ecx, eax
je 00007F23086C3266h
xor eax, eax
dec eax
cmpxchg dword ptr [0003427Ch], ecx
jne 00007F23086C3240h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F23086C3249h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [00034267h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [00034257h], al
call 00007F23086C3833h
call 00007F23086C4952h
test al, al
jne 00007F23086C3256h
xor al, al
jmp 00007F23086C3266h
call 00007F23086D18F1h
test al, al
jne 00007F23086C325Bh
xor ecx, ecx
call 00007F23086C4962h
jmp 00007F23086C323Ch
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003421Ch], 00000000h
mov ebx, ecx
jne 00007F23086C32B9h
cmp ecx, 01h
jnbe 00007F23086C32BCh
call 00007F23086C399Ah
test eax, eax
je 00007F23086C327Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3cdcc	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0x10e34	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x42000	0x22a4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0x75c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a330	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3a1f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x420	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29c90	0x29e00	62616acf257019688180f494b4eb78d4	False	0.5523087686567164	data	6.4831047330596565	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12bf4	0x12c00	4cbd6e497485cdcb2e7d153f20d4f2e7	False	0.5184375	data	5.834994210614785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x3338	0xe00	99d84572872f2ce8d9bdbc2521e1966e	False	0.1328125	Matlab v4 mat-file (little endian) f\324\377\3772\242\337-\231+, text, rows 4294967295, columns 0	1.8271683819747706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x42000	0x22a4	0x2400	39f0a7d8241a665fc55289b5f9977819	False	0.4720052083333333	data	5.316391891279308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x45000	0x15c	0x200	624222957a635749731104f8cdf6f9b7	False	0.38671875	data	2.83326547900447	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x46000	0x10e34	0x11000	2be902e1194d879622f139b94ca07301	False	0.15340647977941177	data	3.990049962265339	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0x75c	0x800	4138d4447f190c2657ec208ef31be551	False	0.5458984375	data	5.240127521097618	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x460e8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 60472 x 60472 px/m	0.14468236129184905
RT_GROUP_ICON	0x56910	0x14	data	1.15
RT_MANIFEST	0x56924	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	IsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 10:11:16.763633013 CET	49705	443	192.168.2.5	34.224.200.202
Dec 9, 2024 10:11:16.763686895 CET	443	49705	34.224.200.202	192.168.2.5
Dec 9, 2024 10:11:16.763783932 CET	49705	443	192.168.2.5	34.224.200.202
Dec 9, 2024 10:11:18.882863045 CET	49705	443	192.168.2.5	34.224.200.202
Dec 9, 2024 10:11:18.882893085 CET	443	49705	34.224.200.202	192.168.2.5
Dec 9, 2024 10:11:20.618823051 CET	443	49705	34.224.200.202	192.168.2.5
Dec 9, 2024 10:11:20.619719028 CET	49705	443	192.168.2.5	34.224.200.202
Dec 9, 2024 10:11:20.619750977 CET	443	49705	34.224.200.202	192.168.2.5
Dec 9, 2024 10:11:20.621193886 CET	443	49705	34.224.200.202	192.168.2.5
Dec 9, 2024 10:11:20.621260881 CET	49705	443	192.168.2.5	34.224.200.202
Dec 9, 2024 10:11:20.622651100 CET	49705	443	192.168.2.5	34.224.200.202
Dec 9, 2024 10:11:20.622786045 CET	49705	443	192.168.2.5	34.224.200.202

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 10:11:16.464874029 CET	58018	53	192.168.2.5	1.1.1.1
Dec 9, 2024 10:11:16.758297920 CET	53	58018	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 10:11:16.464874029 CET	192.168.2.5	1.1.1.1	0x532e	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 10:11:16.758297920 CET	1.1.1.1	192.168.2.5	0x532e	No error (0)	httpbin.org		34.224.200.202	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:11:16.758297920 CET	1.1.1.1	192.168.2.5	0x532e	No error (0)	httpbin.org		44.196.3.45	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	04:11:09
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\0jNz7djbpp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0jNz7djbpp.exe"
Imagebase:	0x7ff73ec80000
File size:	31'979'318 bytes
MD5 hash:	2BFDA47C91A80443539FB763DC2B6027
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	04:11:13
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\0jNz7djbpp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0jNz7djbpp.exe"
Imagebase:	0x7ff73ec80000
File size:	31'979'318 bytes
MD5 hash:	2BFDA47C91A80443539FB763DC2B6027
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	31

Executed Functions

Function 00007FF73ECA6370 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF73ECA63B5

Part of subcall function 00007FF73ECA5D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA5D1C

Part of subcall function 00007FF73EC9AF0C: RtlFreeHeap.NTDLL(?,?,?,00007FF73ECA3392,?,?,?,00007FF73ECA33CF,?,?,00000000,00007FF73ECA3895,?,?,00000000,00007FF73ECA37C7), ref: 00007FF73EC9AF22
Part of subcall function 00007FF73EC9AF0C: GetLastError.KERNEL32(?,?,?,00007FF73ECA3392,?,?,?,00007FF73ECA33CF,?,?,00000000,00007FF73ECA3895,?,?,00000000,00007FF73ECA37C7), ref: 00007FF73EC9AF2C

Part of subcall function 00007FF73EC9AEC4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF73EC9AEA3,?,?,?,?,?,00007FF73EC930CC), ref: 00007FF73EC9AECD
Part of subcall function 00007FF73EC9AEC4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF73EC9AEA3,?,?,?,?,?,00007FF73EC930CC), ref: 00007FF73EC9AEF2

_get_daylight.LIBCMT ref: 00007FF73ECA63A4

Part of subcall function 00007FF73ECA5D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA5D7C

_get_daylight.LIBCMT ref: 00007FF73ECA661A
_get_daylight.LIBCMT ref: 00007FF73ECA662B
_get_daylight.LIBCMT ref: 00007FF73ECA663C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73ECA687C), ref: 00007FF73ECA6663

Strings

Eastern Standard Time, xrefs: 00007FF73ECA6709
Eastern Summer Time, xrefs: 00007FF73ECA6721

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
Instruction ID: 935ac6b524926e9469eda33b721f6b09f06230603dc28712e6b8aeab334e5e07
Opcode Fuzzy Hash: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
Instruction Fuzzy Hash: BAD1C176E08202A6EB20FF22D8505BDB761EF44784FC08535EA4D43686DF3CE44AE360

Function 00007FF73ECA72BC Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73ECA6FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA7031
Part of subcall function 00007FF73ECA6FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA70AF
Part of subcall function 00007FF73ECA6FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA7100

CreateFileW.KERNELBASE ref: 00007FF73ECA73C2
CreateFileW.KERNEL32 ref: 00007FF73ECA7412
GetLastError.KERNEL32 ref: 00007FF73ECA7442
GetFileType.KERNELBASE ref: 00007FF73ECA7457
GetLastError.KERNEL32 ref: 00007FF73ECA7461
CloseHandle.KERNEL32 ref: 00007FF73ECA7494
CloseHandle.KERNEL32 ref: 00007FF73ECA75F7
CreateFileW.KERNEL32 ref: 00007FF73ECA762C
GetLastError.KERNEL32 ref: 00007FF73ECA763B

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
Instruction ID: a711e2c4ad0592762789e1f4675be02bff0997d3157d713810d89639dc17cb67
Opcode Fuzzy Hash: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
Instruction Fuzzy Hash: A5C1E233B24A4295EB10EF68C4902AC7761FB48BA8B811735DE2E5B7D5DF38D45AD320

Function 00007FF73EC87950 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF73EC8154F), ref: 00007FF73EC879E7

Part of subcall function 00007FF73EC87B60: GetEnvironmentVariableW.KERNEL32(00007FF73EC83A1F), ref: 00007FF73EC87B9A
Part of subcall function 00007FF73EC87B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF73EC87BB7

Part of subcall function 00007FF73EC97DEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC97E05

SetEnvironmentVariableW.KERNEL32 ref: 00007FF73EC87AA1

Part of subcall function 00007FF73EC82B30: MessageBoxW.USER32 ref: 00007FF73EC82C05

Strings

LOADER: Failed to set the TMP environment variable., xrefs: 00007FF73EC879CA
TMP, xrefs: 00007FF73EC879B0
TMP, xrefs: 00007FF73EC8798A, 00007FF73EC87A49, 00007FF73EC87AD7
_MEI%d, xrefs: 00007FF73EC879F5

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: a027e6aea258c43f07e2bc9a46543fc38ad0f37717e376dcca62c7854c850c7b
Instruction ID: bf302a976906479a0b977f5e1bf0fe6f295039ea76e593ad2c8d5c036d6ea732
Opcode Fuzzy Hash: a027e6aea258c43f07e2bc9a46543fc38ad0f37717e376dcca62c7854c850c7b
Instruction Fuzzy Hash: 7C51A321B0925361FD14B762AA652FED2916F88BC0FC45431FD0E8B796FE2CE409A320

Function 00007FF73ECA65EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF73ECA661A

Part of subcall function 00007FF73ECA5D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA5D7C

_get_daylight.LIBCMT ref: 00007FF73ECA662B

Part of subcall function 00007FF73ECA5D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA5D1C

_get_daylight.LIBCMT ref: 00007FF73ECA663C

Part of subcall function 00007FF73ECA5D38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA5D4C

Part of subcall function 00007FF73EC9AF0C: RtlFreeHeap.NTDLL(?,?,?,00007FF73ECA3392,?,?,?,00007FF73ECA33CF,?,?,00000000,00007FF73ECA3895,?,?,00000000,00007FF73ECA37C7), ref: 00007FF73EC9AF22
Part of subcall function 00007FF73EC9AF0C: GetLastError.KERNEL32(?,?,?,00007FF73ECA3392,?,?,?,00007FF73ECA33CF,?,?,00000000,00007FF73ECA3895,?,?,00000000,00007FF73ECA37C7), ref: 00007FF73EC9AF2C

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73ECA687C), ref: 00007FF73ECA6663

Strings

Eastern Standard Time, xrefs: 00007FF73ECA6709
Eastern Summer Time, xrefs: 00007FF73ECA6721

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
Instruction ID: f60d58e12df7bc5fdec6f73a0e26969b8ddd3ac5a3e7d2519eb6e84b8f6ddddf
Opcode Fuzzy Hash: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
Instruction Fuzzy Hash: 2E519F36A18642A6E710FF22E8905BDF760FF48784FC09535EA4D83696DF3CE449A760

Function 00007FF73EC81710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF73EC81806
fread, xrefs: 00007FF73EC818FC
fwrite, xrefs: 00007FF73EC818EC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF73EC817D9
malloc, xrefs: 00007FF73EC8186D
fseek, xrefs: 00007FF73EC8180D
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF73EC81866
Failed to create symbolic link %s!, xrefs: 00007FF73EC81753
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF73EC81726
fopen, xrefs: 00007FF73EC81797
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF73EC818F5
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF73EC818E5
Failed to extract %s: failed to open target file!, xrefs: 00007FF73EC81790

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: 9700799d37cb7dd7bdb1138c0e4ea7450ce332dd9a9464b6d3ee4ba8ff5c532e
Instruction ID: 20300a189e09310fa88972c52a5446f01e1bb7f3eb55a6b6e1937294b6000325
Opcode Fuzzy Hash: 9700799d37cb7dd7bdb1138c0e4ea7450ce332dd9a9464b6d3ee4ba8ff5c532e
Instruction Fuzzy Hash: C451CE61B18642A2EA14BB25E9512BDE3E0BF44B94FC40431EE4D47696EF3CE64CE320

Function 00007FF73EC88950 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0000000100000001,00007FF73EC8414C,00007FF73EC87911,?,00007FF73EC87D26,?,00007FF73EC81785), ref: 00007FF73EC88990
OpenProcessToken.ADVAPI32(?,00007FF73EC87D26,?,00007FF73EC81785), ref: 00007FF73EC889A1
GetTokenInformation.KERNELBASE(?,00007FF73EC87D26,?,00007FF73EC81785), ref: 00007FF73EC889C3
GetLastError.KERNEL32(?,00007FF73EC87D26,?,00007FF73EC81785), ref: 00007FF73EC889CD
GetTokenInformation.KERNELBASE(?,00007FF73EC87D26,?,00007FF73EC81785), ref: 00007FF73EC88A0A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF73EC88A1C
CloseHandle.KERNELBASE(?,00007FF73EC87D26,?,00007FF73EC81785), ref: 00007FF73EC88A34
LocalFree.KERNEL32(?,00007FF73EC87D26,?,00007FF73EC81785), ref: 00007FF73EC88A66
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF73EC88A8D
CreateDirectoryW.KERNELBASE(?,00007FF73EC87D26,?,00007FF73EC81785), ref: 00007FF73EC88A9E

Strings

S-1-3-4, xrefs: 00007FF73EC88A3F
D:(A;;FA;;;%s), xrefs: 00007FF73EC88A49

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 9d301874694f13eee612efc427f36135b77fc192910b60788b949b6aa4b4f411
Instruction ID: 29848dc743efc61978f492047c9384744b115eac176160cd8cce55ef1efeeb6d
Opcode Fuzzy Hash: 9d301874694f13eee612efc427f36135b77fc192910b60788b949b6aa4b4f411
Instruction Fuzzy Hash: 1B41A03261868692EB20AF60F4446EEA360FB84794FC41631EA6E47AD5DF3CE40CD720

Function 00007FF73EC81AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73EC882B0: _fread_nolock.LIBCMT ref: 00007FF73EC8835A

_fread_nolock.LIBCMT ref: 00007FF73EC81B54

Part of subcall function 00007FF73EC82890: MessageBoxW.USER32 ref: 00007FF73EC8299B

Strings

Failed to seek to cookie position!, xrefs: 00007FF73EC81B2C
Error on file., xrefs: 00007FF73EC81C36
Could not allocate buffer for TOC!, xrefs: 00007FF73EC81BD6
fread, xrefs: 00007FF73EC81B66, 00007FF73EC81C10
Failed to read cookie!, xrefs: 00007FF73EC81B5F
malloc, xrefs: 00007FF73EC81BDD
fseek, xrefs: 00007FF73EC81B33
MEI, xrefs: 00007FF73EC81AE2
Could not read full TOC!, xrefs: 00007FF73EC81C09

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: 48a3cce56fb1c2fc23d90f4305464d624e8c6f88618c1eec2050cdc37cf09a3d
Instruction ID: f77c8b645d84fb377ddcc093644d2861256a5bc46b177ba223e1434ec123bc60
Opcode Fuzzy Hash: 48a3cce56fb1c2fc23d90f4305464d624e8c6f88618c1eec2050cdc37cf09a3d
Instruction Fuzzy Hash: 2A51B172B09602A6EB14EF28E54417CB3E0EF48B84F918535E90C87795DF7CE848D764

Function 00007FF73EC88080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73EC88AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF73EC82ABB), ref: 00007FF73EC88B1A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF73EC83D52), ref: 00007FF73EC880CF
GetStartupInfoW.KERNEL32 ref: 00007FF73EC880EE

Part of subcall function 00007FF73EC9AA14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC9AA28

Part of subcall function 00007FF73EC98630: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC98697

GetCommandLineW.KERNEL32 ref: 00007FF73EC8818E
CreateProcessW.KERNELBASE ref: 00007FF73EC881D0
WaitForSingleObject.KERNEL32 ref: 00007FF73EC881E4
GetExitCodeProcess.KERNEL32 ref: 00007FF73EC881F4

Strings

Error creating child process!, xrefs: 00007FF73EC88200
CreateProcessW, xrefs: 00007FF73EC88207

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
Instruction ID: 6621149d73f475e0773f65810a349a59e53915ddbc441f9dbc96de8d7d65eb46
Opcode Fuzzy Hash: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
Instruction Fuzzy Hash: 83415732A08B8292DA20AB64F5552AEF360FF94364F900735E6AD47BD5DF7CD058DB10

Function 00007FF73EC81000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF73EC83EC0: GetModuleFileNameW.KERNEL32(?,00007FF73EC839EA), ref: 00007FF73EC83EF1

SetDllDirectoryW.KERNEL32 ref: 00007FF73EC83BE9

Part of subcall function 00007FF73EC87B60: GetEnvironmentVariableW.KERNEL32(00007FF73EC83A1F), ref: 00007FF73EC87B9A
Part of subcall function 00007FF73EC87B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF73EC87BB7

Strings

_MEIPASS2, xrefs: 00007FF73EC83A0B, 00007FF73EC83A74, 00007FF73EC83D22, 00007FF73EC83D2E
Failed to convert DLL search path!, xrefs: 00007FF73EC83BD1
_PYI_ONEDIR_MODE, xrefs: 00007FF73EC83A34, 00007FF73EC83A5F
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF73EC83AC6
MEI, xrefs: 00007FF73EC83B1B
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF73EC83B60

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 961709e27c457eb7e7d62568ba5cf74f7b3efaffa6cfd352c1cb815f9f4d264f
Instruction ID: 2562d6dc5d684b36b54a86feffbc5cb11e687b9aab9d89735f04ca6bf1cdc901
Opcode Fuzzy Hash: 961709e27c457eb7e7d62568ba5cf74f7b3efaffa6cfd352c1cb815f9f4d264f
Instruction Fuzzy Hash: 0FB1B221B2C68761EA25BB25DA502FDE390BF44784FC01131EA4D47696EF2CF51DE720

Function 00007FF73EC81050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF73EC810F1
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF73EC810B4
1.2.13, xrefs: 00007FF73EC8107E
malloc, xrefs: 00007FF73EC810F8, 00007FF73EC81126
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF73EC8111F
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF73EC81249

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 88534f2458b0e3989dbead5018ec6a961dab2d1cdbb689051e36372a7615677e
Instruction ID: 0a2cdcd5574bcceb76bd50ee6ad88638728b9891e9a76b98b9d4143432eaff42
Opcode Fuzzy Hash: 88534f2458b0e3989dbead5018ec6a961dab2d1cdbb689051e36372a7615677e
Instruction Fuzzy Hash: 4351C222A09A82A5EA64BB51E5403BEE3D0FF84794FC44131ED4D87795EF3CE949E720

Function 00007FF73EC9C01C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC9C449

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
Instruction ID: 462884fb159993a80201f46bf36585164b2d2fba6f2190dbbe492b9eaf0259df
Opcode Fuzzy Hash: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
Instruction Fuzzy Hash: C2C1C422A0CB86A1EA50AB5594406BDB754FF96B80FD50135F94D07792EF7CE84DA320

Function 00007FF73EC9D520 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF73EC9D50B), ref: 00007FF73EC9D63C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF73EC9D50B), ref: 00007FF73EC9D6C7

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
Instruction ID: a828e56f8647921b44a183d68e1ea037d44a910ff76159ae0de8258567345c26
Opcode Fuzzy Hash: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
Instruction Fuzzy Hash: A6910972F18651E5F750EF6994502BDAFA0BB40B88F944139EE0E67685EF3CD489E320

Function 00007FF73EC9FCEC Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF73EC9FDDC
_get_daylight.LIBCMT ref: 00007FF73EC9FDED
_get_daylight.LIBCMT ref: 00007FF73EC9FDFE
_isindst.LIBCMT ref: 00007FF73EC9FEC9

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
Instruction ID: 74f9a55ab75c2bf4581d6cec0b2fcc8dab748aff1ae5f19ce80438fe48ef6d81
Opcode Fuzzy Hash: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
Instruction Fuzzy Hash: 9351F772F04152AAFB24EF34D9556BCB7A1AB00358F904135FD1E62BE6EB38A409D720

Function 00007FF73EC95854 Relevance: 6.1, APIs: 4, Instructions: 119
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FF73EC95887
GetFileInformationByHandle.KERNELBASE ref: 00007FF73EC958E9
GetLastError.KERNEL32 ref: 00007FF73EC9597A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF73EC9578C), ref: 00007FF73EC959C6

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 76a0635d5597b22ce5d2941ff6046abd28e8f163941117926f9164ef5776c06c
Instruction ID: d890197255b5124c4986cd71ce1d933640ea632a35df08c7adb1c713f51df794
Opcode Fuzzy Hash: 76a0635d5597b22ce5d2941ff6046abd28e8f163941117926f9164ef5776c06c
Instruction Fuzzy Hash: DE51A222E086419AFB10EF70D4503BDB7A1BF44B58F518535EE4D4769AEF38D4999330

Function 00007FF73EC8C07C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF73EC8C08B

Part of subcall function 00007FF73EC8C24C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF73EC8C26E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF73EC8C0A0
__scrt_release_startup_lock.LIBCMT ref: 00007FF73EC8C10E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF73EC8C161

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
Instruction ID: 6bd44bcb7d837b63b4bd83d1f1089ab27e628fc78175b31d9730db01e507c18f
Opcode Fuzzy Hash: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
Instruction Fuzzy Hash: 6D312821A0824361FA24BB649692BBDA3D19F41784FC45439E94E472E7DE3CAC4DA232

Function 00007FF73EC95700 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC9572D
CreateFileW.KERNELBASE ref: 00007FF73EC9576C
CloseHandle.KERNEL32 ref: 00007FF73EC957A1

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
Instruction ID: 630146af3a16b0b30e54cdf08346b7460ee5d844905f1ee2614bbd306ae49a00
Opcode Fuzzy Hash: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
Instruction Fuzzy Hash: 7A419522D2878193EB50AB60951037DA360FF95764F509334FA5C07AD6EF7CA5E89720

Function 00007FF73EC9027C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC902C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC903B7

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7abeb8fe783ee1c87e05308e58bf334fc2d3c30e054771bdd4fe3d83d7422279
Instruction ID: ff10258c545b82e018f088f07e0de8f2528e7872a5afa6c89118180eeb44fb08
Opcode Fuzzy Hash: 7abeb8fe783ee1c87e05308e58bf334fc2d3c30e054771bdd4fe3d83d7422279
Instruction Fuzzy Hash: 60512A21B09652A6FA64BE36940177EE281BF44BA4F944734FD7C877C5EF3CD808A620

Function 00007FF73EC9C6F4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF73EC9C88D), ref: 00007FF73EC9C740
GetLastError.KERNEL32(?,?,?,?,?,00007FF73EC9C88D), ref: 00007FF73EC9C74A

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
Instruction ID: 0744251c375d6d1797fe24592bbeae8af1ba6754eea4723629b98d8dadba0cda
Opcode Fuzzy Hash: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
Instruction Fuzzy Hash: 34110E62A18B8191EA20AB25B44016DA361AB85BF4F940331EEBD0B7E9DF3CD4499700

Function 00007FF73EC959FC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73EC95911), ref: 00007FF73EC95A2F
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73EC95911), ref: 00007FF73EC95A45

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
Instruction ID: 97904b17133fc21e2e260ab6c8f5f26844e1bdaa2abada730ddb623cd09d200a
Opcode Fuzzy Hash: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
Instruction Fuzzy Hash: 9211E33260C64291EB54AB01A44103EF7B0FB85760F900235FB9D899E8EF3CD018EB20

Function 00007FF73EC9AF0C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF73ECA3392,?,?,?,00007FF73ECA33CF,?,?,00000000,00007FF73ECA3895,?,?,00000000,00007FF73ECA37C7), ref: 00007FF73EC9AF22
GetLastError.KERNEL32(?,?,?,00007FF73ECA3392,?,?,?,00007FF73ECA33CF,?,?,00000000,00007FF73ECA3895,?,?,00000000,00007FF73ECA37C7), ref: 00007FF73EC9AF2C

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
Instruction ID: 1094ae57cb618c96ff2f7fe738b689f6f5183765799ed75160b83a0b9a457acf
Opcode Fuzzy Hash: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
Instruction Fuzzy Hash: 20E0C290F0960276FF58BBF2984907D92919F88B01FC04834EC0E87393FE2C689D6230

Function 00007FF73EC9B11C Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF73EC9AF99,?,?,00000000,00007FF73EC9B04E), ref: 00007FF73EC9B18A
GetLastError.KERNEL32(?,?,?,00007FF73EC9AF99,?,?,00000000,00007FF73EC9B04E), ref: 00007FF73EC9B194

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
Instruction ID: 89af4eb29cb6917fd74d3a184c4b68fe93192a493e7d3364cc26e54e3a2a74cf
Opcode Fuzzy Hash: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
Instruction Fuzzy Hash: 8D21EB21F1868271FE90B764A4553BD92826F84BE0FC44235FA5E477D1EE6CE44DA321

Function 00007FF73EC9C46C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC9C494

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 491d756dfbf5d606f7e783a7bab36e7eaa3001c20d525fc7b9da7dd63869e3d6
Instruction ID: f5feb4aad33a48c216fa4a6981f58fa7eebeec87ccc0cfe18eb581b404fd18e1
Opcode Fuzzy Hash: 491d756dfbf5d606f7e783a7bab36e7eaa3001c20d525fc7b9da7dd63869e3d6
Instruction Fuzzy Hash: 8E41DA72908241A7EA34EB29E54067DB7A0EB56B41F900131FA8D477D1DF3CE806E771

Function 00007FF73EC882B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF73EC8835A

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: f38816a1396df6c3fe935ea55d49c1b180c6beea1b2607ef6d81d6429394b577
Instruction ID: 4cca069e5a90d8742091936cbee6148c0267c1f3a4ac3c902b95106c23d643a0
Opcode Fuzzy Hash: f38816a1396df6c3fe935ea55d49c1b180c6beea1b2607ef6d81d6429394b577
Instruction Fuzzy Hash: 6321A122B0869266FB50BA126A047FEE651BF55FD4FCC5430EE0D07B86DE3CE449E624

Function 00007FF73EC9BEFC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC9BF82

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 33c1c355f770a45dc32ec47b5556db51f5a056321d098f55ce731dda09118c74
Instruction ID: 48a51a8904bb685aecade054e82ac8860a7862d0c64a9a8413f69a12281c1877
Opcode Fuzzy Hash: 33c1c355f770a45dc32ec47b5556db51f5a056321d098f55ce731dda09118c74
Instruction Fuzzy Hash: 6B31A126A18642A5FB41BB5588413BCA650AF80BA2FC10135FE1D073D3EF7CE44AA735

Function 00007FF73EC964A8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC9640D

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction ID: c3b91505a8e6720d2d5c53f0b37a838a3038b82c6ab1c6da231a21d4cf67fa13
Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction Fuzzy Hash: 80115E22A1C68591EE60FF91940127EE2A4BF85B84F844431FE8D47AC6EF7CD544B764

Function 00007FF73ECA6CAC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA6CCF

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
Instruction ID: a73b8974eafc4549c3a15d63eb301f721ef48df8dcb0910861cfa09f7bfcd15a
Opcode Fuzzy Hash: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
Instruction Fuzzy Hash: DF21D432A18A4597DB60AF18E4403BDB3A0FB84B98F944634EA5D476DADF3CD409DB10

Function 00007FF73EC904FC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC90550

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction ID: ebdec45de4f41f07211785dfd3bb1378bad6fedbc7b0d4183261203bc65b7fb9
Opcode Fuzzy Hash: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction Fuzzy Hash: B501C461A0874151EA04FB66990126DE795BF85FE0F884630FE6C97BD6EE3CE405A324

Function 00007FF73EC9F158 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF73EC9B9A6,?,?,?,00007FF73EC9AB67,?,?,00000000,00007FF73EC9AE02), ref: 00007FF73EC9F1AD

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
Instruction ID: 400843165b7115ea3deda4046bb06519b63f20295dd2a7a3f59e2474825e301d
Opcode Fuzzy Hash: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
Instruction Fuzzy Hash: F3F06D55B09286A1FE947662D9202BDC2915F88B50FCC4430FD0E963D2FE1CE489A2B0

Function 00007FF73EC9DBBC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF73EC90D24,?,?,?,00007FF73EC92236,?,?,?,?,?,00007FF73EC93829), ref: 00007FF73EC9DBFA

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
Instruction ID: f08d0da74c6532a7899a2c5539db6d8d7cb8de99a145f238f0626a00172adf6c
Opcode Fuzzy Hash: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
Instruction Fuzzy Hash: ECF0FE55B0D247E5FE547662992127DD6905F44764F884730FD2E962C2EE5CA488A130

Non-executed Functions

Function 00007FF73EC86EF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF73EC86F07
GetProcAddress.KERNEL32 ref: 00007FF73EC86F46
GetProcAddress.KERNEL32 ref: 00007FF73EC86F6B
GetProcAddress.KERNEL32 ref: 00007FF73EC86F90
GetProcAddress.KERNEL32 ref: 00007FF73EC86FB8
GetProcAddress.KERNEL32 ref: 00007FF73EC86FE0
GetProcAddress.KERNEL32 ref: 00007FF73EC87008
GetProcAddress.KERNEL32 ref: 00007FF73EC87030
GetProcAddress.KERNEL32 ref: 00007FF73EC87058

Strings

Failed to get address for Tcl_EvalEx, xrefs: 00007FF73EC87312
Tcl_NewStringObj, xrefs: 00007FF73EC8722E
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF73EC8715A
Tcl_Init, xrefs: 00007FF73EC86F00
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF73EC8710A
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF73EC87132
Tcl_Alloc, xrefs: 00007FF73EC87346
Tcl_ConditionNotify, xrefs: 00007FF73EC870EE
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF73EC86F58
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF73EC8701A
Tcl_FindExecutable, xrefs: 00007FF73EC86F61
Tcl_Free, xrefs: 00007FF73EC8736E
Tcl_EvalFile, xrefs: 00007FF73EC872CE
Tcl_FinalizeThread, xrefs: 00007FF73EC86FD6
Failed to get address for Tcl_Finalize, xrefs: 00007FF73EC86FCA
Failed to get address for Tcl_Init, xrefs: 00007FF73EC86F19
Tcl_ThreadQueueEvent, xrefs: 00007FF73EC8713E
Tcl_MutexLock, xrefs: 00007FF73EC87076
Tcl_GetVar2, xrefs: 00007FF73EC8718E
Tcl_GetObjResult, xrefs: 00007FF73EC872A6
Tcl_EvalObjv, xrefs: 00007FF73EC8731E
Tcl_MutexUnlock, xrefs: 00007FF73EC8709E
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF73EC86FA2
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF73EC8733A
Failed to get address for Tcl_SetVar2, xrefs: 00007FF73EC871D2
Tcl_DeleteInterp, xrefs: 00007FF73EC86FFE
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF73EC87272
Failed to get address for Tcl_Free, xrefs: 00007FF73EC8738A
Tcl_SetVar2Ex, xrefs: 00007FF73EC8727E
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF73EC870E2
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF73EC87182
Failed to get address for Tcl_Alloc, xrefs: 00007FF73EC87362
Tcl_Finalize, xrefs: 00007FF73EC86FAE
GetProcAddress, xrefs: 00007FF73EC86F20
Failed to get address for Tcl_MutexLock, xrefs: 00007FF73EC87092
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF73EC86F7D
Tcl_GetCurrentThread, xrefs: 00007FF73EC8704E
Tcl_EvalEx, xrefs: 00007FF73EC872F6
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF73EC871FA
Tcl_NewByteArrayObj, xrefs: 00007FF73EC87256
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF73EC8706A
Failed to get address for Tk_Init, xrefs: 00007FF73EC873B2
Tcl_ConditionWait, xrefs: 00007FF73EC87116
Tk_Init, xrefs: 00007FF73EC87396
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF73EC86FF2
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF73EC8724A
Tcl_CreateInterp, xrefs: 00007FF73EC86F3C
Tk_GetNumMainWindows, xrefs: 00007FF73EC873BE
Failed to get address for Tcl_EvalFile, xrefs: 00007FF73EC872EA
Failed to get address for Tcl_CreateThread, xrefs: 00007FF73EC87042
Tcl_ConditionFinalize, xrefs: 00007FF73EC870C6
Failed to get address for Tcl_GetVar2, xrefs: 00007FF73EC871AA
Tcl_SetVar2, xrefs: 00007FF73EC871B6
Failed to get address for Tcl_GetString, xrefs: 00007FF73EC87222
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF73EC872C2
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF73EC873DA
Tcl_GetString, xrefs: 00007FF73EC87206
Tcl_CreateThread, xrefs: 00007FF73EC87026
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF73EC870BA
Tcl_DoOneEvent, xrefs: 00007FF73EC86F86
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF73EC8729A
Tcl_ThreadAlert, xrefs: 00007FF73EC87166
Tcl_CreateObjCommand, xrefs: 00007FF73EC871DE

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
Instruction ID: 523ba88adce863668715ce4ddad33c30606fe8ecb75c1a8b5c98ed7067a0dc83
Opcode Fuzzy Hash: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
Instruction Fuzzy Hash: 4FE1C364A1DB07F0FA59BB04A9601BCEBA1AF05744FC45835D85E463A4EF7CF94CA320

Function 00007FF73EC81F50 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF73EC81F9E
MulDiv.KERNEL32 ref: 00007FF73EC81FB2
MulDiv.KERNEL32 ref: 00007FF73EC81FD3
SystemParametersInfoW.USER32 ref: 00007FF73EC8201B
CreateFontIndirectW.GDI32 ref: 00007FF73EC8202F
#380.COMCTL32 ref: 00007FF73EC82053
CreateWindowExW.USER32 ref: 00007FF73EC820A6
CreateWindowExW.USER32 ref: 00007FF73EC82100
CreateWindowExW.USER32 ref: 00007FF73EC8215D
CreateWindowExW.USER32 ref: 00007FF73EC821BF
SendMessageW.USER32 ref: 00007FF73EC821DF
SendMessageW.USER32 ref: 00007FF73EC821F9
SendMessageW.USER32 ref: 00007FF73EC82218
SendMessageW.USER32 ref: 00007FF73EC82237
SendMessageW.USER32 ref: 00007FF73EC82255
SendMessageW.USER32 ref: 00007FF73EC82273
SendMessageW.USER32 ref: 00007FF73EC82291
SendMessageW.USER32 ref: 00007FF73EC822A9
SendMessageW.USER32 ref: 00007FF73EC822C1
GetClientRect.USER32 ref: 00007FF73EC822D0

Part of subcall function 00007FF73EC823F0: GetDC.USER32 ref: 00007FF73EC8241B
Part of subcall function 00007FF73EC823F0: SelectObject.GDI32 ref: 00007FF73EC82462
Part of subcall function 00007FF73EC823F0: DrawTextW.USER32 ref: 00007FF73EC82485
Part of subcall function 00007FF73EC823F0: SelectObject.GDI32 ref: 00007FF73EC8249B
Part of subcall function 00007FF73EC823F0: ReleaseDC.USER32 ref: 00007FF73EC824AB
Part of subcall function 00007FF73EC823F0: MoveWindow.USER32 ref: 00007FF73EC824FB
Part of subcall function 00007FF73EC823F0: MoveWindow.USER32 ref: 00007FF73EC8253B
Part of subcall function 00007FF73EC823F0: MoveWindow.USER32 ref: 00007FF73EC8258E

Strings

EDIT, xrefs: 00007FF73EC8210B
Close, xrefs: 00007FF73EC82168
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF73EC81F7D
BUTTON, xrefs: 00007FF73EC82176
STATIC, xrefs: 00007FF73EC8205C, 00007FF73EC820B1

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction ID: 963a94bbe301d8d5d92eea96929701f4f80bb91313fb4d406ad2fe359fb6d0fb
Opcode Fuzzy Hash: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction Fuzzy Hash: C9A19A76218B85A7E3149F61E45479EB770F788B84F904529EB9D03B24CF3DE168CB10

Function 00007FF73ECA471C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF73ECA476A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA4DD6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA4F4C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA520A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA542A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA5667
memcpy_s.LIBCPMT ref: 00007FF73ECA5742
memcpy_s.LIBCPMT ref: 00007FF73ECA57ED
memcpy_s.LIBCPMT ref: 00007FF73ECA58BC

Strings

1#IND, xrefs: 00007FF73ECA4857
1#INF, xrefs: 00007FF73ECA4893
1#SNAN, xrefs: 00007FF73ECA487A
1#QNAN, xrefs: 00007FF73ECA4883

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 462ebf29a53f9f8e0898a565754c8078d18c0a01f6b8af8c35fed8b76f3e05ac
Instruction ID: a4db505fbebe3930b4146a083e60ef3b68ac5f34e5efa75a72d7ba6f28fd5200
Opcode Fuzzy Hash: 462ebf29a53f9f8e0898a565754c8078d18c0a01f6b8af8c35fed8b76f3e05ac
Instruction Fuzzy Hash: 2FB22372E182829BEB64DF64D440BFDB7B1FB44388F805935DA0D57A89DB38E908DB50

Function 00007FF73EC88560 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF73EC82A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF73EC8101D), ref: 00007FF73EC88587
FormatMessageW.KERNEL32 ref: 00007FF73EC885B6
WideCharToMultiByte.KERNEL32 ref: 00007FF73EC8860C

Part of subcall function 00007FF73EC829E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF73EC887F2,?,?,?,?,?,?,?,?,?,?,?,00007FF73EC8101D), ref: 00007FF73EC82A14
Part of subcall function 00007FF73EC829E0: MessageBoxW.USER32 ref: 00007FF73EC82AF0

Strings

FormatMessageW, xrefs: 00007FF73EC885C7
Failed to encode wchar_t as UTF-8., xrefs: 00007FF73EC88616
No error messages generated., xrefs: 00007FF73EC885C0
PyInstaller: FormatMessageW failed., xrefs: 00007FF73EC885D3
WideCharToMultiByte, xrefs: 00007FF73EC8861D
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF73EC88629

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
Instruction ID: 2885824df1d5ff4635475cedd586e3d53db30c3d6474d629d63eac1d8e15471d
Opcode Fuzzy Hash: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
Instruction Fuzzy Hash: 89215071A1CA43A1F724AB15F8542AEA7A1FF88388FC40535E64D836A4DF7CE54DE720

Function 00007FF73EC8C57C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF73EC8C598
RtlCaptureContext.KERNEL32 ref: 00007FF73EC8C5C5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF73EC8C5DF
RtlVirtualUnwind.KERNEL32 ref: 00007FF73EC8C620
IsDebuggerPresent.KERNEL32 ref: 00007FF73EC8C674
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF73EC8C695
UnhandledExceptionFilter.KERNEL32 ref: 00007FF73EC8C6A0

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
Instruction ID: 609c15e7960bab9eccd790d5e26d3eff67da14af290c6464a92bc94247654371
Opcode Fuzzy Hash: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
Instruction Fuzzy Hash: 03315072618B8196EB60AF60E8507EDB3A4FB84744F84443ADB4D47B94DF38D64CD724

Function 00007FF73EC9ABD8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF73EC9AC51
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF73EC9AC69
RtlVirtualUnwind.KERNEL32 ref: 00007FF73EC9ACA4
IsDebuggerPresent.KERNEL32 ref: 00007FF73EC9ACDD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF73EC9ACE7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF73EC9ACF2

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
Instruction ID: 7dab62f9660a4bd5aeb4ceb72ed9fb02900a1768babda7cbeb051cb49eb817b3
Opcode Fuzzy Hash: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
Instruction Fuzzy Hash: 2B31A232618F8196DB60DF25E8403AEB3A4FB89794F900136EA9D43B98DF3CD549CB10

Function 00007FF73ECA1EE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA1F30
FindFirstFileExW.KERNEL32 ref: 00007FF73ECA203A

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
Instruction ID: 0e44cfc406c1d9d7a70fd5f390a9dec9773dde1862a0e0fab4668151566dd438
Opcode Fuzzy Hash: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
Instruction Fuzzy Hash: 0BB1F762B186A251EB64EB22E8001BDE391EB44BE4F844531FE5E07BC5DF3CE859E310

Function 00007FF73EC8C460 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF73EC8C48C
GetCurrentThreadId.KERNEL32 ref: 00007FF73EC8C49A
GetCurrentProcessId.KERNEL32 ref: 00007FF73EC8C4A6
QueryPerformanceCounter.KERNEL32 ref: 00007FF73EC8C4B6

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
Instruction ID: 9827a9df305aba1f9500154048f817084f82b90f49cf06c7c515948f67ad8523
Opcode Fuzzy Hash: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
Instruction Fuzzy Hash: 66117032B54F0699EB00DF60E8442BD73A4FB18B58F841E31EA6D467A4DF7CD1989390

Function 00007FF73ECA4280 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF73ECA42E6
memcpy_s.LIBCPMT ref: 00007FF73ECA4311

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 93d13d081e3f87f917c9023294261f6d91e5fe0d503cb3f723b501f3db39ae9b
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: CAC11472B1928697EB24DF59A0446BEF7A1F794B84F858534DB4E47B84DB3CE809CB00

Function 00007FF73ECA9FF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF73ECAA247
RaiseException.KERNEL32 ref: 00007FF73ECAA258

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: b4cdb5d9b405a5f2b155a4653528c407a9956d0b6218a393af626003cf1b5a24
Instruction ID: 78fc8c93d7f3c0195ebd821ba6cc150a876d20c7a3dcf525530354c0a97027f4
Opcode Fuzzy Hash: b4cdb5d9b405a5f2b155a4653528c407a9956d0b6218a393af626003cf1b5a24
Instruction Fuzzy Hash: 4EB17B73604B898BEB59CF29C84636CBBA0F784B48F548D22DB6D837A4CB3AD455D710

Function 00007FF73EC888D0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF73EC88901
FindClose.KERNEL32 ref: 00007FF73EC88910

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
Instruction ID: 4c71c0c8ffa64e1644080006e1aa93427afa185715085c4ca781c309a33cf7f0
Opcode Fuzzy Hash: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
Instruction Fuzzy Hash: 93F08172A1C68586E7609F64B4587AEB390FB44724F840735E67D02AD4DF3CD00CEA10

Function 00007FF73EC93AE4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF73EC93C52
, xrefs: 00007FF73EC93E94

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 631a3e48eb673e1850d57232dc56befdf755ff5fd67b38a64b6ca9c49a913018
Instruction ID: b4161eccfd12524a221419f23fdccc88b128d7e5a65bd2fec079e3cbded53a28
Opcode Fuzzy Hash: 631a3e48eb673e1850d57232dc56befdf755ff5fd67b38a64b6ca9c49a913018
Instruction Fuzzy Hash: 35E1EB32A18A4695EB68AF2D805017DB3A0FF45B48F945235EE0E077D4EF39F859E710

Function 00007FF73EC9E4B0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF73EC9E5BD
gfff, xrefs: 00007FF73EC9E63A

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 95f5c728ca916dfdd01defb08dd518f9d9b28e517fc4b7b4370436378f7798ef
Instruction ID: 15929c1f6363b2bd78c8988f08e7a296ffc2968f0f7c377b45344b5d787e25ff
Opcode Fuzzy Hash: 95f5c728ca916dfdd01defb08dd518f9d9b28e517fc4b7b4370436378f7798ef
Instruction Fuzzy Hash: 85518A23B182C59AE7249E359900B6DF7D1E754B94F888231EBAC47AC5EE3DD408D710

Function 00007FF73ECA0F38 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 4b7c577155937df3467bd9cdd4550942c9176b8fc8785c5dc3f7c97a7b0e1b3f
Instruction ID: 55657795ff585a792a7e4bff4647a50a9e40e1bf852bc374fa065ff1dad232ff
Opcode Fuzzy Hash: 4b7c577155937df3467bd9cdd4550942c9176b8fc8785c5dc3f7c97a7b0e1b3f
Instruction Fuzzy Hash: C202C2A1B0D753A0FB51BB22940127DE694AF41BA0FC44A35ED6E477D2EE3CE449A330

Function 00007FF73EC9E01C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF73EC9E35E

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
Instruction ID: 798465ff6e4a0b18b7cdb30f7a621b589c1e9e3e85c89282834888a6a914f65a
Opcode Fuzzy Hash: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
Instruction Fuzzy Hash: 30A14773A087C59AEB21DB25E400BADBBD1AB60B84F448131EE8D47782EE3DE509D711

Function 00007FF73EC986D0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF73EC986EF

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: cf0abd2c7e4acdbc7dd987358b9028f2a59d8daca936b72b1b12d96a797a3aac
Instruction ID: 7a1e1e2d19dc054c81c99bdfaaaf4fd04d94c42e7baad5b012beeced26371dbc
Opcode Fuzzy Hash: cf0abd2c7e4acdbc7dd987358b9028f2a59d8daca936b72b1b12d96a797a3aac
Instruction Fuzzy Hash: 6251A016F0875261FA68BA2699111BED291BF44BC4FC84534FE0E47796FF3CE40AA224

Function 00007FF73ECA3AF0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF73ECA3AF4

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
Instruction ID: a5ce8c680bafa6f22463d8cdb01f2719e3e9c67c9153342d64877501a080e099
Opcode Fuzzy Hash: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
Instruction Fuzzy Hash: 23B01220F1BB46D2EB483B926C8621C62B47F48B00FD44038D24C41330DE3C25FE6720

Function 00007FF73EC936E0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208e6a978d65b3df04c2d2163cfe11b9ca3e791e60348233d6b397c6ac133608
Instruction ID: c84a0f580bcbe8b088c856b9d2265a0c2d0b6d3615eee05fec9020740f9f7e8b
Opcode Fuzzy Hash: 208e6a978d65b3df04c2d2163cfe11b9ca3e791e60348233d6b397c6ac133608
Instruction Fuzzy Hash: BDD1F562E08642A5EB28AB2D814427DA7A0FF05B48F944235EE0D077D5EF3DF85DE364

Function 00007FF73EC88FD0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926518188b614a96dab23eca74cd6fab0ac352dd7b9dabb22d14e7e66e5c8c54
Instruction ID: b07112d39a80b6ffa45ea82a9c0a5f42d6fcbc5c50d6ba618b1ee79bb2425534
Opcode Fuzzy Hash: 926518188b614a96dab23eca74cd6fab0ac352dd7b9dabb22d14e7e66e5c8c54
Instruction Fuzzy Hash: 5AC114322142F08BD698FB29E45947A73E2F7E9309BD5403AEB874B785C63CE414E760

Function 00007FF73EC92D50 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67fe5c4df14f10fbabbc179396d5558260dc0a4d214c0f6109c6307dd6f74d9
Instruction ID: e67d563f41db437d5a566d348e39f224c3043dad171ba5182f89c61fc96c050e
Opcode Fuzzy Hash: b67fe5c4df14f10fbabbc179396d5558260dc0a4d214c0f6109c6307dd6f74d9
Instruction Fuzzy Hash: 69B1BE7290878595E7A8DF39D09023CBBA0F709F48FA41135EA8E47395EF39E449E724

Function 00007FF73EC9EB30 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41de09fd609196546d8b05baa0994189bc53ea50dddfb86cdccda31fca7eba1c
Instruction ID: f6b3fd90f7a4c032cdf72dd0b9b9722da59d66f1dfc8bce87d152bfae9865091
Opcode Fuzzy Hash: 41de09fd609196546d8b05baa0994189bc53ea50dddfb86cdccda31fca7eba1c
Instruction Fuzzy Hash: 94810672A0C7815AE774EF1994807BEA6D1FB65790F844235FA8D43B85EF3DE0089B10

Function 00007FF73ECA6D70 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3a6143a7b5f00f0189e4837f13cf3fad345f6e9eb837262b3e4ffc84bd4cc460
Instruction ID: b97dbcc0fee370f381062903e2178aadb7bf8331a314c224082ae81d0a1d445f
Opcode Fuzzy Hash: 3a6143a7b5f00f0189e4837f13cf3fad345f6e9eb837262b3e4ffc84bd4cc460
Instruction Fuzzy Hash: 0E613C22F0C28666FB64EA28C45077DF691AF40774F940A39E62D43BC5DE7DE80DA720

Function 00007FF73EC91E94 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction ID: 4d0a5b39d5c6560734cec2f07d5712a4861968f432e0d0788f1c36c608b91b27
Opcode Fuzzy Hash: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction Fuzzy Hash: 1F51E532A1865592E7649B28D04523CB3A0EB48F6CFA55131EE8C077D4EF3AEC47E790

Function 00007FF73EC922A4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction ID: 0ad9e2dc77ae0d6a20faebe0fe315856027d88ee07d9798f6d9e0539e47cf9bf
Opcode Fuzzy Hash: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction Fuzzy Hash: 6851C936A18651D1E7A89B29E04023CB3A4FB54F68FA44131EECD07794EB3AE847E750

Function 00007FF73EC91A84 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction ID: e69105ade666907e06127f426a2d1d73951436397a2731800d44cbbcc0a3e389
Opcode Fuzzy Hash: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction Fuzzy Hash: 2951E576A18A5196E7249F29C04123CB3A1EB44F68FA54131EE4C077D4EF3AEC5BE750

Function 00007FF73EC920A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction ID: db7ea558ff99444326a29990607acf551c2f9545d6ec899bc366ebe77b18ac5c
Opcode Fuzzy Hash: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction Fuzzy Hash: E8510736A18A5191E7A89B28E04033CB7A1EB44F58FA44131EF8C17795EF3AEC57E750

Function 00007FF73EC91880 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction ID: 3ec97433b4d3f412b8c732b1299a9bf665d110ca4f4209527a34da18856ab9d1
Opcode Fuzzy Hash: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction Fuzzy Hash: 7E51E232B1875195E7249B29C04133CA3A1EB48B58FA64131EE4C1B794EF3AEC57E790

Function 00007FF73EC91C90 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction ID: 5ce55cb8c54f32dfb068ca321f54ef500d04e8e0c055bc6d4a22685370def61e
Opcode Fuzzy Hash: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction Fuzzy Hash: 1051D233A1865196E7259B29C04537CB7A0EB48F58FA64131EE8C07798EF3AEC47E750

Function 00007FF73EC95F30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 919fd30b44d5ca2f872f738fd682fe73618d13d7a431ec24eb390e4a072302a2
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: F4410652C0D74E95ED61992C45006BCA6809F327F0DD862B4FDAD173C7FC0E658EA230

Function 00007FF73EC9A430 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2970ddd5f501fe71afef01217e103934546d8fb7f20af68bec1b913dc8647c23
Instruction ID: 2855119bd73cf21466130dbb1865df0e0a2c53154bf0819809e4f6e582853e95
Opcode Fuzzy Hash: 2970ddd5f501fe71afef01217e103934546d8fb7f20af68bec1b913dc8647c23
Instruction Fuzzy Hash: BB411972B18A5591FF18DF2AD91416DB3A1B748FD0B849032EE4D87B58EF3CD44AA310

Function 00007FF73EC97C98 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
Instruction ID: cdab14640226bbe8b74a2899069911c091bf9c44e370eac4686493f5089ac970
Opcode Fuzzy Hash: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
Instruction Fuzzy Hash: 5631C532709B8242E764EF25A44027DA6D5AF84B90F544238FE4D53BD6EF3CD416A314

Function 00007FF73ECA9E40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dada551c461b21fdad657b6bac4cbdfad31b05eb9b59333086b2e0a15b162055
Instruction ID: 30c39e2bf88a01dfd84447b184a0655bcb3bdf7efffb2a829d63d0180c23c602
Opcode Fuzzy Hash: dada551c461b21fdad657b6bac4cbdfad31b05eb9b59333086b2e0a15b162055
Instruction Fuzzy Hash: D4F0C2B1B186959ADBA49F29A80262DB7E0F7483C4F84C079E6CC83F04C63C80A29F14

Function 00007FF73EC8C760 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5749315d7b24dceccc8714b5042f108a7de79c1631c17c6a95dc8ed6b888950b
Instruction ID: ec91eae25123ba1878066a77e25126f63bbf2dd652175f4a75643d35f3897039
Opcode Fuzzy Hash: 5749315d7b24dceccc8714b5042f108a7de79c1631c17c6a95dc8ed6b888950b
Instruction Fuzzy Hash: EAA0022191CC06F0E644AB10F950478A770FB52300BD00431F14D410A09F3CA959E321

Function 00007FF73EC851E0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF73EC8346E), ref: 00007FF73EC851F0
GetProcAddress.KERNEL32(?,?,00000000,00007FF73EC8346E), ref: 00007FF73EC8522A
GetProcAddress.KERNEL32(?,?,00000000,00007FF73EC8346E), ref: 00007FF73EC8524F
GetProcAddress.KERNEL32(?,?,00000000,00007FF73EC8346E), ref: 00007FF73EC85274
GetProcAddress.KERNEL32(?,?,00000000,00007FF73EC8346E), ref: 00007FF73EC8529C
GetProcAddress.KERNEL32(?,?,00000000,00007FF73EC8346E), ref: 00007FF73EC852C4
GetProcAddress.KERNEL32(?,?,00000000,00007FF73EC8346E), ref: 00007FF73EC852EC
GetProcAddress.KERNEL32(?,?,00000000,00007FF73EC8346E), ref: 00007FF73EC85314
GetProcAddress.KERNEL32(?,?,00000000,00007FF73EC8346E), ref: 00007FF73EC8533C
GetProcAddress.KERNEL32(?,?,00000000,00007FF73EC8346E), ref: 00007FF73EC85364

Strings

Failed to get address for PyObject_GetAttrString, xrefs: 00007FF73EC85696
PyObject_CallFunctionObjArgs, xrefs: 00007FF73EC85652
PyErr_Restore, xrefs: 00007FF73EC854C2
PySys_SetObject, xrefs: 00007FF73EC85792
Failed to get address for PySys_GetObject, xrefs: 00007FF73EC85786
PyConfig_Clear, xrefs: 00007FF73EC8530A
PyErr_Occurred, xrefs: 00007FF73EC85472
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF73EC857D6
Py_IsInitialized, xrefs: 00007FF73EC852BA
PySys_GetObject, xrefs: 00007FF73EC8576A
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF73EC8570E
PyConfig_SetString, xrefs: 00007FF73EC853AA
PyUnicode_FromString, xrefs: 00007FF73EC8585A
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF73EC853EE
PyStatus_Exception, xrefs: 00007FF73EC85742
PyUnicode_Replace, xrefs: 00007FF73EC858AA
PyErr_NormalizeException, xrefs: 00007FF73EC8544A
PyModule_GetDict, xrefs: 00007FF73EC85602
PyRun_SimpleStringFlags, xrefs: 00007FF73EC8571A
PyMem_RawFree, xrefs: 00007FF73EC855DA
Failed to get address for PyEval_EvalCode, xrefs: 00007FF73EC85506
Failed to get address for PyErr_Occurred, xrefs: 00007FF73EC8548E
PyEval_EvalCode, xrefs: 00007FF73EC854EA
PyUnicode_AsUTF8, xrefs: 00007FF73EC857BA
Py_DecRef, xrefs: 00007FF73EC851E6
PyUnicode_DecodeFSDefault, xrefs: 00007FF73EC8580A
PyUnicode_Decode, xrefs: 00007FF73EC857E2
Failed to get address for Py_ExitStatusException, xrefs: 00007FF73EC85261
Py_Finalize, xrefs: 00007FF73EC8526A
Failed to get address for PyUnicode_FromString, xrefs: 00007FF73EC85876
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF73EC8584E
Failed to get address for Py_DecodeLocale, xrefs: 00007FF73EC8523C
Py_PreInitialize, xrefs: 00007FF73EC852E2
PyMarshal_ReadObjectFromString, xrefs: 00007FF73EC855B2
PyImport_ImportModule, xrefs: 00007FF73EC85562
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF73EC856BE
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF73EC85826
Py_InitializeFromConfig, xrefs: 00007FF73EC85292
PyErr_Print, xrefs: 00007FF73EC8549A
Failed to get address for PyStatus_Exception, xrefs: 00007FF73EC8575E
Failed to get address for PyErr_Fetch, xrefs: 00007FF73EC8543E
PyObject_CallFunction, xrefs: 00007FF73EC8562A
PyImport_ExecCodeModule, xrefs: 00007FF73EC8553A
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF73EC8534E
Failed to get address for PyUnicode_Join, xrefs: 00007FF73EC8589E
Failed to get address for PyModule_GetDict, xrefs: 00007FF73EC8561E
Failed to get address for PyImport_AddModule, xrefs: 00007FF73EC8552E
GetProcAddress, xrefs: 00007FF73EC85209
Py_ExitStatusException, xrefs: 00007FF73EC85245
PyObject_Str, xrefs: 00007FF73EC856CA
Failed to get address for PyList_Append, xrefs: 00007FF73EC855A6
PyErr_Clear, xrefs: 00007FF73EC853FA
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF73EC85556
Failed to get address for PyObject_Str, xrefs: 00007FF73EC856E6
Failed to get address for PyErr_Restore, xrefs: 00007FF73EC854DE
Failed to get address for Py_IsInitialized, xrefs: 00007FF73EC852D6
Failed to get address for PyErr_Print, xrefs: 00007FF73EC854B6
PyConfig_SetBytesString, xrefs: 00007FF73EC85382
Py_DecodeLocale, xrefs: 00007FF73EC85220
Failed to get address for PyMem_RawFree, xrefs: 00007FF73EC855F6
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF73EC85466
Failed to get address for PyConfig_Read, xrefs: 00007FF73EC85376
PyObject_GetAttrString, xrefs: 00007FF73EC8567A
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF73EC855CE
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF73EC85736
Failed to get address for PyUnicode_Replace, xrefs: 00007FF73EC858C6
PyConfig_InitIsolatedConfig, xrefs: 00007FF73EC85332
Failed to get address for PyObject_CallFunction, xrefs: 00007FF73EC85646
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF73EC852AE
PyUnicode_Join, xrefs: 00007FF73EC85882
PyList_Append, xrefs: 00007FF73EC8558A
PyObject_SetAttrString, xrefs: 00007FF73EC856A2
Failed to get address for Py_Finalize, xrefs: 00007FF73EC85286
Failed to get address for Py_PreInitialize, xrefs: 00007FF73EC852FE
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF73EC8566E
PyErr_Fetch, xrefs: 00007FF73EC85422
PyConfig_Read, xrefs: 00007FF73EC8535A
Failed to get address for PyErr_Clear, xrefs: 00007FF73EC85416
PyConfig_SetWideStringList, xrefs: 00007FF73EC853D2
PyImport_AddModule, xrefs: 00007FF73EC85512
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF73EC856F2
Failed to get address for PySys_SetObject, xrefs: 00007FF73EC857AE
Failed to get address for Py_DecRef, xrefs: 00007FF73EC85202
Failed to get address for PyConfig_SetString, xrefs: 00007FF73EC853C6
Failed to get address for PyConfig_Clear, xrefs: 00007FF73EC85326
PyUnicode_FromFormat, xrefs: 00007FF73EC85832
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF73EC8539E
Failed to get address for PyImport_ImportModule, xrefs: 00007FF73EC8557E
Failed to get address for PyUnicode_Decode, xrefs: 00007FF73EC857FE

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
Instruction ID: fdcc909839e88992326c98733b903e60304ad1f096611973793fbc9e406fec88
Opcode Fuzzy Hash: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
Instruction Fuzzy Hash: 15129064A1EB03B0FE59FB18A95057CA3A1AF45740BD46835C85E063A5EFBCB94CF360

Function 00007FF73EC812B0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73EC82B30: MessageBoxW.USER32 ref: 00007FF73EC82C05

_fread_nolock.LIBCMT ref: 00007FF73EC81499

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF73EC8132B
%s%c%s, xrefs: 00007FF73EC813EE
fread, xrefs: 00007FF73EC814C6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF73EC814BF
\, xrefs: 00007FF73EC813F5
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF73EC81370
malloc, xrefs: 00007FF73EC81377
Failed to extract %s: failed to open archive file!, xrefs: 00007FF73EC812FE
fseek, xrefs: 00007FF73EC81332

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: eb36bb45857c16b44edd36685c31993014ae0f224cc39bafccf1feedf175797d
Instruction ID: f9a65f57eaed4b54745324c0fc072373aeb775a9a7c69c34dcceb9dade9c39cb
Opcode Fuzzy Hash: eb36bb45857c16b44edd36685c31993014ae0f224cc39bafccf1feedf175797d
Instruction Fuzzy Hash: FA51A021B1868366EA20B721A9516FEA394EF447C4FC05431FE5D47B86EE7CE549A320

Function 00007FF73EC823F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF73EC8241B
SelectObject.GDI32 ref: 00007FF73EC82462
DrawTextW.USER32 ref: 00007FF73EC82485
SelectObject.GDI32 ref: 00007FF73EC8249B
ReleaseDC.USER32 ref: 00007FF73EC824AB
MoveWindow.USER32 ref: 00007FF73EC824FB
MoveWindow.USER32 ref: 00007FF73EC8253B
MoveWindow.USER32 ref: 00007FF73EC8258E
MoveWindow.USER32 ref: 00007FF73EC825D6

Strings

P%, xrefs: 00007FF73EC8246F

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction ID: 01fd99268d69d8cca0301ccfed9eeb6f907f78d09c2facd91e4252744e2f0327
Opcode Fuzzy Hash: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction Fuzzy Hash: B551D7266147A186D6349F26E4181BEF7A1FB98B61F404125EFDE43794DF3CD049DB20

Function 00007FF73EC967A4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC967E7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC96BD4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC96E70

Strings

-, xrefs: 00007FF73EC9687D
p, xrefs: 00007FF73EC96899
f, xrefs: 00007FF73EC96909
:, xrefs: 00007FF73EC969A0
p, xrefs: 00007FF73EC96911

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
Instruction ID: 457c7547d250530f8e5ef8e9bc712281c8a16e19d6ac947fb296229c8a113cc1
Opcode Fuzzy Hash: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
Instruction Fuzzy Hash: 19129072E0C24BA6FB20BA14D1546BDF6A1EB80754FC48035F699476C4FF3CE588AB25

Function 00007FF73EC91108 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC91148
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC91510
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC917AF

Strings

p, xrefs: 00007FF73EC911ED
f, xrefs: 00007FF73EC9124A
p, xrefs: 00007FF73EC91252
f, xrefs: 00007FF73EC911E0
f, xrefs: 00007FF73EC91395

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction ID: 3737fe274db12c10d8a32bb3b8b9961a7d3c587eaed0bf7b11e871da267d9b3c
Opcode Fuzzy Hash: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction Fuzzy Hash: DE12A632E0C243A6FB60BA15E0466BDF291FB40754FC64135F69A476C4EF3CE588AB24

Function 00007FF73EC815A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF73EC81609
fread, xrefs: 00007FF73EC816C9
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF73EC816C2
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF73EC81639
malloc, xrefs: 00007FF73EC81640
Failed to extract %s: failed to open archive file!, xrefs: 00007FF73EC815D3
fseek, xrefs: 00007FF73EC81610

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: fc4d00e68c10bc6cfa12e2fd898941efbd925022891e855d312ef2fb0d8dc3ae
Instruction ID: 12589e614495e177d2d95567762210e9406d5257f0426b963dfb9af83291aca8
Opcode Fuzzy Hash: fc4d00e68c10bc6cfa12e2fd898941efbd925022891e855d312ef2fb0d8dc3ae
Instruction Fuzzy Hash: 4231BF21B18643A6EE24BB51E5401BEE3A0FF047C4FD84432EE8D07A56EE3CF549A720

Function 00007FF73EC8EB00 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF73EC8EB5D

Part of subcall function 00007FF73EC8FA70: __GetUnwindTryBlock.LIBCMT ref: 00007FF73EC8FAB3
Part of subcall function 00007FF73EC8FA70: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF73EC8FAD8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF73EC8EC35
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF73EC8EE8A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF73EC8EF96

Strings

csm, xrefs: 00007FF73EC8EB77
csm, xrefs: 00007FF73EC8EC58
csm, xrefs: 00007FF73EC8EBDE

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
Instruction ID: a79463e4da345e9489cfdbbaef4ae5213c7affadc8d8f6519238d70c50b1c895
Opcode Fuzzy Hash: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
Instruction Fuzzy Hash: 6FE1C532A08741AAEB20EF25D9403BDBBA0FB45788F900135EE4D57B95DF38E488D712

Function 00007FF73EC9F1D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF73EC9F56A,?,?,0000016995626938,00007FF73EC9B317,?,?,?,00007FF73EC9B20E,?,?,?,00007FF73EC96452), ref: 00007FF73EC9F34C
GetProcAddress.KERNEL32(?,?,?,00007FF73EC9F56A,?,?,0000016995626938,00007FF73EC9B317,?,?,?,00007FF73EC9B20E,?,?,?,00007FF73EC96452), ref: 00007FF73EC9F358

Strings

ext-ms-, xrefs: 00007FF73EC9F2A9
api-ms-, xrefs: 00007FF73EC9F296

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
Instruction ID: e981ad036d82b0dc33a9295760403b76da4ce3aadeeab296932f7d81843f0a9c
Opcode Fuzzy Hash: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
Instruction Fuzzy Hash: 0B414861B19A4261FA16EB16AC0067DA391BF44BE0FD84535ED2D67784EF3CE44DE320

Function 00007FF73EC886B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73EC8101D), ref: 00007FF73EC88747
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73EC8101D), ref: 00007FF73EC8879E

Strings

win32_utils_to_utf8, xrefs: 00007FF73EC887D6
Failed to get UTF-8 buffer size., xrefs: 00007FF73EC887DF
Failed to encode wchar_t as UTF-8., xrefs: 00007FF73EC887C6
WideCharToMultiByte, xrefs: 00007FF73EC887E6
Out of memory., xrefs: 00007FF73EC887CF

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 3d8cc197ee630c3fb00dd31b72f24074ca9fe52add05c6a83a64952da4f63ba4
Instruction ID: 6668a827a24a9c8ee1e404901aa6cfb19e2764542c18d43b2d4eb2d437f50ea2
Opcode Fuzzy Hash: 3d8cc197ee630c3fb00dd31b72f24074ca9fe52add05c6a83a64952da4f63ba4
Instruction Fuzzy Hash: 9E419032A08B8292E620EF55B8401BEF6A1FB84B94FD44535EA8D47F95DF3CD449E720

Function 00007FF73EC88BF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF73EC839EA), ref: 00007FF73EC88C31

Part of subcall function 00007FF73EC829E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF73EC887F2,?,?,?,?,?,?,?,?,?,?,?,00007FF73EC8101D), ref: 00007FF73EC82A14
Part of subcall function 00007FF73EC829E0: MessageBoxW.USER32 ref: 00007FF73EC82AF0

WideCharToMultiByte.KERNEL32(?,00007FF73EC839EA), ref: 00007FF73EC88CA5

Strings

win32_utils_to_utf8, xrefs: 00007FF73EC88C72
Failed to get UTF-8 buffer size., xrefs: 00007FF73EC88C3E
Failed to encode wchar_t as UTF-8., xrefs: 00007FF73EC88CAF
WideCharToMultiByte, xrefs: 00007FF73EC88C45, 00007FF73EC88CB6
Out of memory., xrefs: 00007FF73EC88C6B

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 93215b2962e715be9f5aa91d99be70836a612e16585fb8aee950a2577366c4a3
Instruction ID: 7b50e4512b7b7519ee44b53be6c3699747e7a95e88d0f682825bf0bb88390d3b
Opcode Fuzzy Hash: 93215b2962e715be9f5aa91d99be70836a612e16585fb8aee950a2577366c4a3
Instruction Fuzzy Hash: 60218232A09B42E5EB10EF16E9500BDF6A1FB84B84BD44535D64D43B98EF3CE549D320

Function 00007FF73EC875A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF73EC87716

Part of subcall function 00007FF73EC90250: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC90264

Part of subcall function 00007FF73EC90224: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC90238

Strings

ERROR: file already exists but should not: %s, xrefs: 00007FF73EC8767C
WARNING: file already exists but should not: %s, xrefs: 00007FF73EC87698
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF73EC87632
%s%c%s, xrefs: 00007FF73EC875E5
\, xrefs: 00007FF73EC875EC

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: 716029066da9aa7fdbb7f0bfe734846ac928b4b9348b4955f396da70c2eca7e6
Instruction ID: 1b8ed4f6a5882f096b2e2f49ca5765b979218047c6c6813ad84981e1a966fa30
Opcode Fuzzy Hash: 716029066da9aa7fdbb7f0bfe734846ac928b4b9348b4955f396da70c2eca7e6
Instruction Fuzzy Hash: B7517C21A0D65365FA25BB25AA512BDE291AF85B80FC40130FD5DC77D6FE2CE90CE360

Function 00007FF73EC8DDB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF73EC8E06A,?,?,?,00007FF73EC8DD5C,?,?,00000001,00007FF73EC8D979), ref: 00007FF73EC8DE3D
GetLastError.KERNEL32(?,?,?,00007FF73EC8E06A,?,?,?,00007FF73EC8DD5C,?,?,00000001,00007FF73EC8D979), ref: 00007FF73EC8DE4B
LoadLibraryExW.KERNEL32(?,?,?,00007FF73EC8E06A,?,?,?,00007FF73EC8DD5C,?,?,00000001,00007FF73EC8D979), ref: 00007FF73EC8DE75
FreeLibrary.KERNEL32(?,?,?,00007FF73EC8E06A,?,?,?,00007FF73EC8DD5C,?,?,00000001,00007FF73EC8D979), ref: 00007FF73EC8DEBB
GetProcAddress.KERNEL32(?,?,?,00007FF73EC8E06A,?,?,?,00007FF73EC8DD5C,?,?,00000001,00007FF73EC8D979), ref: 00007FF73EC8DEC7

Strings

api-ms-, xrefs: 00007FF73EC8DE5D

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
Instruction ID: 17b179d22e905ef566df3095baa8a12c43d9507b9a244f7acc6191e74d22ca81
Opcode Fuzzy Hash: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
Instruction Fuzzy Hash: 4931CA22B1A742E1FE61FB02A91057DA7D8BF58B60F990635DE1D47350DF3CE4489320

Function 00007FF73EC87420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73EC88AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF73EC82ABB), ref: 00007FF73EC88B1A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF73EC879A1,00000000,?,00000000,00000000,?,00007FF73EC8154F), ref: 00007FF73EC8747F

Part of subcall function 00007FF73EC82B30: MessageBoxW.USER32 ref: 00007FF73EC82C05

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF73EC874DA
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF73EC87456
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF73EC87493

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
Instruction ID: be4fd403066ea98afeea9c9bb842d0131bba9817f39c0db7b5deede83a6d3727
Opcode Fuzzy Hash: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
Instruction Fuzzy Hash: 8A317751B1D783A0FA24B721E6553BED691AF987C0FC40435DA4E82796FE2CE50C9720

Function 00007FF73EC88AE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF73EC82ABB), ref: 00007FF73EC88B1A

Part of subcall function 00007FF73EC829E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF73EC887F2,?,?,?,?,?,?,?,?,?,?,?,00007FF73EC8101D), ref: 00007FF73EC82A14
Part of subcall function 00007FF73EC829E0: MessageBoxW.USER32 ref: 00007FF73EC82AF0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF73EC82ABB), ref: 00007FF73EC88BA0

Strings

win32_utils_from_utf8, xrefs: 00007FF73EC88B69
Failed to decode wchar_t from UTF-8, xrefs: 00007FF73EC88BAA
MultiByteToWideChar, xrefs: 00007FF73EC88B2E, 00007FF73EC88BB1
Out of memory., xrefs: 00007FF73EC88B62
Failed to get wchar_t buffer size., xrefs: 00007FF73EC88B27

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 2a7f0904e5ec1897560545d2159a663e9c273eaf1fea03a0d1ae7df506dc6c73
Instruction ID: a11544321fa7c58fe2fffe4368d41f009adc033e48b934bdbcf0de1b6ef51ded
Opcode Fuzzy Hash: 2a7f0904e5ec1897560545d2159a663e9c273eaf1fea03a0d1ae7df506dc6c73
Instruction Fuzzy Hash: 25218022B18A42A1EB50EB29F9500BEE7A1FF847C8FD84531DB4C93B69EF2CD5459710

Function 00007FF73EC9B710 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF73EC9B71F
FlsGetValue.KERNEL32 ref: 00007FF73EC9B734
FlsSetValue.KERNEL32 ref: 00007FF73EC9B755
FlsSetValue.KERNEL32 ref: 00007FF73EC9B782
FlsSetValue.KERNEL32 ref: 00007FF73EC9B793
FlsSetValue.KERNEL32 ref: 00007FF73EC9B7A4
SetLastError.KERNEL32 ref: 00007FF73EC9B7BF

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5e25a57dc3899cb5d9e1114fbc8c557aa55031a2469902f6cab5e8a78f8e35b9
Instruction ID: 75bdc67bdea3e25152a0a38df0459b1684115b6632451c38cedfc1b016c82937
Opcode Fuzzy Hash: 5e25a57dc3899cb5d9e1114fbc8c557aa55031a2469902f6cab5e8a78f8e35b9
Instruction Fuzzy Hash: ED218B24A0C28776FA687B31565517DE282AF44BB0F900734F83E56BC6EE2CE4096635

Function 00007FF73ECA85BC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF73ECA85ED
GetLastError.KERNEL32 ref: 00007FF73ECA85F9
CloseHandle.KERNEL32 ref: 00007FF73ECA8611
CreateFileW.KERNEL32 ref: 00007FF73ECA863C
WriteConsoleW.KERNEL32 ref: 00007FF73ECA865B

Strings

CONOUT$, xrefs: 00007FF73ECA861D

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
Instruction ID: 24e4307a2b3b89c3691107955025d34703e293bb2a200e710f3375a02164db66
Opcode Fuzzy Hash: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
Instruction Fuzzy Hash: 16119622B18A429AF7509B42F85436DB7A0FB48FE4F440635EA5E477A4CF3CD4488754

Function 00007FF73EC9B888 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF73EC954CD,?,?,?,?,00007FF73EC9F1BF,?,?,00000000,00007FF73EC9B9A6,?,?,?), ref: 00007FF73EC9B897
FlsSetValue.KERNEL32(?,?,?,00007FF73EC954CD,?,?,?,?,00007FF73EC9F1BF,?,?,00000000,00007FF73EC9B9A6,?,?,?), ref: 00007FF73EC9B8CD
FlsSetValue.KERNEL32(?,?,?,00007FF73EC954CD,?,?,?,?,00007FF73EC9F1BF,?,?,00000000,00007FF73EC9B9A6,?,?,?), ref: 00007FF73EC9B8FA
FlsSetValue.KERNEL32(?,?,?,00007FF73EC954CD,?,?,?,?,00007FF73EC9F1BF,?,?,00000000,00007FF73EC9B9A6,?,?,?), ref: 00007FF73EC9B90B
FlsSetValue.KERNEL32(?,?,?,00007FF73EC954CD,?,?,?,?,00007FF73EC9F1BF,?,?,00000000,00007FF73EC9B9A6,?,?,?), ref: 00007FF73EC9B91C
SetLastError.KERNEL32(?,?,?,00007FF73EC954CD,?,?,?,?,00007FF73EC9F1BF,?,?,00000000,00007FF73EC9B9A6,?,?,?), ref: 00007FF73EC9B937

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 941158fb4e6d3a9375e13d6d10033e8ffcdbbced4d4dd5e625aa307a16b34608
Instruction ID: d303c0816bb450fe8020bc02746eb34bd35e10183d4312f98819c4aec250b72f
Opcode Fuzzy Hash: 941158fb4e6d3a9375e13d6d10033e8ffcdbbced4d4dd5e625aa307a16b34608
Instruction Fuzzy Hash: 9C118E20A0C787B6FA187B31564517DE252AF487B0FD40734F87E566C6EE2CB8096625

Function 00007FF73EC8D778 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF73EC8D7A3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF73EC8D838
RtlUnwindEx.KERNEL32 ref: 00007FF73EC8D887

Strings

f, xrefs: 00007FF73EC8D7B6
csm, xrefs: 00007FF73EC8D81E

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
Instruction ID: 01ab5ddfcc4b2331de115c3b4a3fcdbd086ff1ec368de1487dade0cd17dea73f
Opcode Fuzzy Hash: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
Instruction Fuzzy Hash: 3851D333A19202EADB14EB11E514A3DBB99FB80B94F918034DE5E47748DF38E848D710

Function 00007FF73EC82600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF73EC827EF), ref: 00007FF73EC82638
DialogBoxIndirectParamW.USER32 ref: 00007FF73EC826FC
DeleteObject.GDI32 ref: 00007FF73EC8272F
DestroyIcon.USER32 ref: 00007FF73EC82741

Strings

Unhandled exception in script, xrefs: 00007FF73EC82668

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
Instruction ID: eb82ea808592cda2b5c91244cab7835170724a0c13d53a4cc927553612fe6aed
Opcode Fuzzy Hash: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
Instruction Fuzzy Hash: 75319072A19A8299EB24FF61E9552FDA3A0FF88784F800135EA4D4BB59DF3CD109D710

Function 00007FF73EC829E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF73EC887F2,?,?,?,?,?,?,?,?,?,?,?,00007FF73EC8101D), ref: 00007FF73EC82A14

Part of subcall function 00007FF73EC88560: GetLastError.KERNEL32(00000000,00007FF73EC82A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF73EC8101D), ref: 00007FF73EC88587
Part of subcall function 00007FF73EC88560: FormatMessageW.KERNEL32 ref: 00007FF73EC885B6

Part of subcall function 00007FF73EC88AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF73EC82ABB), ref: 00007FF73EC88B1A

MessageBoxW.USER32 ref: 00007FF73EC82AF0
MessageBoxA.USER32 ref: 00007FF73EC82B0C

Strings

Fatal error detected, xrefs: 00007FF73EC82AC6, 00007FF73EC82AFE
%s%s: %s, xrefs: 00007FF73EC82A6B

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
Instruction ID: 95f27fc8ad1a28797c7f776dd68675c0a8711c680d5c3b7e5fb75f4346317a4b
Opcode Fuzzy Hash: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
Instruction Fuzzy Hash: BC317472628686A1E630EB10E4516EEE3A4FF847C4FC04136E68D03A99DF3CD709DB50

Function 00007FF73EC9A018 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF73EC9A03D
GetProcAddress.KERNEL32 ref: 00007FF73EC9A053
FreeLibrary.KERNEL32 ref: 00007FF73EC9A07A

Strings

mscoree.dll, xrefs: 00007FF73EC9A034
CorExitProcess, xrefs: 00007FF73EC9A04C

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
Instruction ID: 6bd2feb3275d3688e77298dc51f60a17566686501293d1d6a70b94268c34015b
Opcode Fuzzy Hash: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
Instruction Fuzzy Hash: 74F0C861A1970261FB146B54E84437DE760EF49760FC40635D56E451E4DF3DD04CD360

Function 00007FF73ECA9C40 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF73ECA9C68
_set_statfp.LIBCMT ref: 00007FF73ECA9C83
_set_statfp.LIBCMT ref: 00007FF73ECA9C9F
_set_statfp.LIBCMT ref: 00007FF73ECA9CDB

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: bb4dd5d7d7b6f719e3abbe75f38d0495920887201876f922a3bb59682d4c438a
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: 16118C32E58E4331F6543528F84737DD4C16F98368E980E34E96E067DACE2CE84C6220

Function 00007FF73EC9B950 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF73EC9AB67,?,?,00000000,00007FF73EC9AE02,?,?,?,?,?,00007FF73EC930CC), ref: 00007FF73EC9B96F
FlsSetValue.KERNEL32(?,?,?,00007FF73EC9AB67,?,?,00000000,00007FF73EC9AE02,?,?,?,?,?,00007FF73EC930CC), ref: 00007FF73EC9B98E
FlsSetValue.KERNEL32(?,?,?,00007FF73EC9AB67,?,?,00000000,00007FF73EC9AE02,?,?,?,?,?,00007FF73EC930CC), ref: 00007FF73EC9B9B6
FlsSetValue.KERNEL32(?,?,?,00007FF73EC9AB67,?,?,00000000,00007FF73EC9AE02,?,?,?,?,?,00007FF73EC930CC), ref: 00007FF73EC9B9C7
FlsSetValue.KERNEL32(?,?,?,00007FF73EC9AB67,?,?,00000000,00007FF73EC9AE02,?,?,?,?,?,00007FF73EC930CC), ref: 00007FF73EC9B9D8

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4fc6ccaa14371e387e5c22fb95057e46c3ade10dd54edcd3ce0e48e5b46d1de5
Instruction ID: 43487ff58ec1b53e5242ba6f400e8d961afbb14b6799eb0d6596e74e00286df6
Opcode Fuzzy Hash: 4fc6ccaa14371e387e5c22fb95057e46c3ade10dd54edcd3ce0e48e5b46d1de5
Instruction Fuzzy Hash: 9F11AF20B0828375FA58BB26954127DE1516F407B0F944334F87E567C6EE2CE809A621

Function 00007FF73EC9B7E4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF73EC9B7F5
FlsSetValue.KERNEL32 ref: 00007FF73EC9B814
FlsSetValue.KERNEL32 ref: 00007FF73EC9B83C
FlsSetValue.KERNEL32 ref: 00007FF73EC9B84D
FlsSetValue.KERNEL32 ref: 00007FF73EC9B85E

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 64fe73475c7f3c5e3ff0e30dd8e21900901c314ca9004384e47b330d372873f3
Instruction ID: cd38af794da3dcb7b8f1e86090c9d4156231ce332b86104a63501d9ca48ab69f
Opcode Fuzzy Hash: 64fe73475c7f3c5e3ff0e30dd8e21900901c314ca9004384e47b330d372873f3
Instruction Fuzzy Hash: 3F112A20E0934B76F96C7A3158511BD92815F48B70ED40734F83E5A2D3FD2CB4097639

Function 00007FF73EC964B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC964F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC9661A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC966D0

Strings

verbose, xrefs: 00007FF73EC964C4

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction ID: ef0cd2f4a0ba8c2d204aaaa84b41bf7bffdaab962569764e7260c04f7de2e110
Opcode Fuzzy Hash: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction Fuzzy Hash: BC91E372A0C64AA1FB61AF25D45077DB7A0AF40B94FC44136EA5E473D5EF3CE849A320

Function 00007FF73ECA05A8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA0887

Part of subcall function 00007FF73ECA69C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA69E1

Strings

ccs, xrefs: 00007FF73ECA07C2
UTF-8, xrefs: 00007FF73ECA0806
UTF-16LEUNICODE, xrefs: 00007FF73ECA0825

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
Instruction ID: b42d6ad51032a2f4765b4f7699595d9e6631ce1baf53b6a477608b537104461b
Opcode Fuzzy Hash: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
Instruction Fuzzy Hash: 3C81D672D0C202A5F7647F25821237CB6A0AB11BC8FD58835DA0E97295DF3DE809BB61

Function 00007FF73EC8EFD8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF73EC8F024
_CallSETranslator.LIBVCRUNTIME ref: 00007FF73EC8F073

Strings

MOC, xrefs: 00007FF73EC8F038
RCC, xrefs: 00007FF73EC8F041

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
Instruction ID: 4616d04145302c1359f273b46593fcea716a6631a329c65dacdfe488a2d170d6
Opcode Fuzzy Hash: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
Instruction Fuzzy Hash: 2A61A133A08B899AE710EF65D5403ADBBA0F744B88F444225EF5D27B95DF38E059C710

Function 00007FF73EC8F334 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF73EC8F35C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF73EC8F444

Strings

csm, xrefs: 00007FF73EC8F496
csm, xrefs: 00007FF73EC8F37E

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
Instruction ID: b25d54b0d639b32a827b0b17f0b55e40e0bba95fe00cd1d82d4797a552b57f5a
Opcode Fuzzy Hash: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
Instruction Fuzzy Hash: 8651F1329082C6A6EB70AF11964437DB7A0FB94B84F844136DA9D97BC5CF3CE458EB10

Function 00007FF73EC82890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73EC88AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF73EC82ABB), ref: 00007FF73EC88B1A

MessageBoxW.USER32 ref: 00007FF73EC8299B
MessageBoxA.USER32 ref: 00007FF73EC829B7

Strings

Fatal error detected, xrefs: 00007FF73EC82971, 00007FF73EC829A9
%s%s: %s, xrefs: 00007FF73EC82916

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
Instruction ID: 30db18396f95338717a5ba87b488c8d961f223243365e54dc2ec350001dd428b
Opcode Fuzzy Hash: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
Instruction Fuzzy Hash: A2312472628682A1E620F710E5516DEA3A4FF847C4FC04536E68D47A99DF3CD709DB60

Function 00007FF73EC83EC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF73EC839EA), ref: 00007FF73EC83EF1

Part of subcall function 00007FF73EC829E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF73EC887F2,?,?,?,?,?,?,?,?,?,?,?,00007FF73EC8101D), ref: 00007FF73EC82A14
Part of subcall function 00007FF73EC829E0: MessageBoxW.USER32 ref: 00007FF73EC82AF0

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF73EC83F2A
GetModuleFileNameW, xrefs: 00007FF73EC83F02
Failed to get executable path., xrefs: 00007FF73EC83EFB

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
Instruction ID: d0dd265ee189b743c8e700cc12b6c912f6da64451096fd0bf340d9f8ea1789de
Opcode Fuzzy Hash: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
Instruction Fuzzy Hash: 9E018461B2D64360FA60B728E9553BD9291AF487C4FC01431E85E86292EE2CF50DE720

Function 00007FF73EC9CB60 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF73EC9CBDF
WriteFile.KERNEL32 ref: 00007FF73EC9CEA7
WriteFile.KERNEL32 ref: 00007FF73EC9CEED
GetLastError.KERNEL32 ref: 00007FF73EC9CFA3

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
Instruction ID: d7dcd2ceac3e131a707b1de8adde7e4ec3dcd5462e004bbe93057a50da913f12
Opcode Fuzzy Hash: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
Instruction Fuzzy Hash: DBD13572B18A81A9E710DF78D4406ECB7B1FB45B98B844235EE5D57BC9EE38D80AD310

Function 00007FF73EC82330 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF73EC82364
SetWindowLongPtrW.USER32 ref: 00007FF73EC82386
GetWindowLongPtrW.USER32 ref: 00007FF73EC823B0
InvalidateRect.USER32 ref: 00007FF73EC823D0

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction ID: 347fb82d282f495a3a545351bdbe95bf3dee87c7d501df706bc1c65d11f55bc1
Opcode Fuzzy Hash: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction Fuzzy Hash: A0110C21E1814292F758AB69F6582BD9295EF95B80FC48030EA4907B8DCD3CD8C96610

Function 00007FF73ECA628C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73ECA1DD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA1E03

_get_daylight.LIBCMT ref: 00007FF73ECA63A4
_get_daylight.LIBCMT ref: 00007FF73ECA63B5

Strings

?, xrefs: 00007FF73ECA6335

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
Instruction ID: f8ae6104680d5b4f058377e311e2d68e12ec6c3180df77852ca0f879762b0303
Opcode Fuzzy Hash: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
Instruction Fuzzy Hash: 3E412822A0838662FB20AB25E44137EE660EF90BA4F944635EF9C06BD5DF3CD44AD710

Function 00007FF73EC995A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73EC995D6

Part of subcall function 00007FF73EC9AF0C: RtlFreeHeap.NTDLL(?,?,?,00007FF73ECA3392,?,?,?,00007FF73ECA33CF,?,?,00000000,00007FF73ECA3895,?,?,00000000,00007FF73ECA37C7), ref: 00007FF73EC9AF22
Part of subcall function 00007FF73EC9AF0C: GetLastError.KERNEL32(?,?,?,00007FF73ECA3392,?,?,?,00007FF73ECA33CF,?,?,00000000,00007FF73ECA3895,?,?,00000000,00007FF73ECA37C7), ref: 00007FF73EC9AF2C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF73EC8BFE5), ref: 00007FF73EC995F4

Strings

C:\Users\user\Desktop\0jNz7djbpp.exe, xrefs: 00007FF73EC995E2

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\0jNz7djbpp.exe
API String ID: 3580290477-390583679
Opcode ID: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
Instruction ID: 8fc9bca8d1289b0e0d85ceaf683ed7aa5c841802064c2d3ea4304462ce156fda
Opcode Fuzzy Hash: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
Instruction Fuzzy Hash: FF417D72A08B12A6EB54FF2594411BDF7A4EF84784B944035FD4E47B85EF3DE489A320

Function 00007FF73EC9D1F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF73EC9D30F
GetLastError.KERNEL32 ref: 00007FF73EC9D331

Strings

U, xrefs: 00007FF73EC9D2BB

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
Instruction ID: b1de1c511ed1853168138e4a7658920279c8f6376b80df8f676e83fbed34de78
Opcode Fuzzy Hash: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
Instruction Fuzzy Hash: 5741D222A18A8191EB20AF25E4543ADA760FB88780FC14035EE4D87798EF3CD449D720

Function 00007FF73EC9F918 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF73EC9F958
GetCurrentDirectoryW.KERNEL32 ref: 00007FF73EC9F9AA

Strings

:, xrefs: 00007FF73EC9F96E

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 4482f0b2aa88d097fa4b172b4d0b9d8fa621ceaf6a6e580bcf5a02da10cef38f
Instruction ID: b92fe2d26a85f6c830445993989e41672ee6147e70eba0872a589c8b8bd049c3
Opcode Fuzzy Hash: 4482f0b2aa88d097fa4b172b4d0b9d8fa621ceaf6a6e580bcf5a02da10cef38f
Instruction Fuzzy Hash: D6210772B186C1A1FB20AB15D04527DB3B2FB84B48FD24035EA9D53284EF7CE949D761

Function 00007FF73EC82B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73EC88AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF73EC82ABB), ref: 00007FF73EC88B1A

MessageBoxW.USER32 ref: 00007FF73EC82C05
MessageBoxA.USER32 ref: 00007FF73EC82C21

Strings

Fatal error detected, xrefs: 00007FF73EC82BDB, 00007FF73EC82C13

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
Instruction ID: 2f609a37d640d9480a58df34d157d15376a03df8eeb2f007a5b0aeec62cc91f7
Opcode Fuzzy Hash: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
Instruction Fuzzy Hash: 72218372628682A1E720EB10F5916EEE364FF84788FC05135E69D47AA5DF3CD219DB20

Function 00007FF73EC82C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73EC88AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF73EC82ABB), ref: 00007FF73EC88B1A

MessageBoxW.USER32 ref: 00007FF73EC82D25
MessageBoxA.USER32 ref: 00007FF73EC82D41

Strings

Error detected, xrefs: 00007FF73EC82CFB, 00007FF73EC82D33

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
Instruction ID: 1aa7019958501743896fd6200d7a4acd3b9f679e7d5e83ae14711386c11e15d4
Opcode Fuzzy Hash: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
Instruction Fuzzy Hash: 14216772628686A1E720E710F5916EEF354FF84788FC05135E68D47A65DF3CD219D720

Function 00007FF73EC8FE80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF73EC8FED0
RaiseException.KERNEL32 ref: 00007FF73EC8FF11

Strings

csm, xrefs: 00007FF73EC8FEFE

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
Instruction ID: e6bd5ab12257a9a25fc8e8405c1d617fd1fa5656ac1cb6eddac409f5b6e28d83
Opcode Fuzzy Hash: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
Instruction Fuzzy Hash: EE119A32618B8492EB608F14F50026EB7E1FB88B84F984234EE8C47B69EF3CC455CB00

Function 00007FF73ECA041C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73ECA044C
GetDriveTypeW.KERNEL32 ref: 00007FF73ECA048C

Strings

:, xrefs: 00007FF73ECA0475

Memory Dump Source

Source File: 00000000.00000002.3298885467.00007FF73EC81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73EC80000, based on PE: true

Associated: 00000000.00000002.3298861927.00007FF73EC80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298916691.00007FF73ECAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3298953313.00007FF73ECC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECC7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3299003268.00007FF73ECD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73ec80000_0jNz7djbpp.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
Instruction ID: 71daa7de49c077735c2267bd6b9d7fb4f4586800c4069fa494414d011688a663
Opcode Fuzzy Hash: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
Instruction Fuzzy Hash: DD01676191C24796FB60BF60946237EA390FF44745FC50439E94D46691EF3CE94CEA34

Analysis Process: 0jNz7djbpp.exePID: 3128, Parent PID: 2352COMMON

Executed Functions

Function 00007FF8B8B01220 Relevance: 673.2, APIs: 191, Strings: 193, Instructions: 1225networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8B8B01258
Py_AtExit.PYTHON312 ref: 00007FF8B8B0126D
PyErr_NewException.PYTHON312 ref: 00007FF8B8B01293
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B8B012B3
PyErr_NewException.PYTHON312 ref: 00007FF8B8B012D5
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B8B012F5
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B8B01317
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B8B01339
PyType_FromMetaclass.PYTHON312 ref: 00007FF8B8B01356
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B8B01375
PyModule_AddType.PYTHON312 ref: 00007FF8B8B01389
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B8B013A8

Part of subcall function 00007FF8B8B01150: PyMem_Malloc.PYTHON312 ref: 00007FF8B8B0115E

PyCapsule_New.PYTHON312 ref: 00007FF8B8B013DB
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B8B013FA
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01426
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01444
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01462
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01480
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0149E
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B014BC
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B014DA
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B014F8
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01516
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01534
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01552
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01570
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0158E
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B015AC
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B015CA
PyModule_AddStringConstant.PYTHON312 ref: 00007FF8B8B015E9
PyModule_AddStringConstant.PYTHON312 ref: 00007FF8B8B01608
PyModule_AddStringConstant.PYTHON312 ref: 00007FF8B8B01627
PyModule_AddStringConstant.PYTHON312 ref: 00007FF8B8B01646
PyModule_AddStringConstant.PYTHON312 ref: 00007FF8B8B01665
PyModule_AddStringConstant.PYTHON312 ref: 00007FF8B8B01684
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B016A2
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B016C0
PyModule_AddStringConstant.PYTHON312 ref: 00007FF8B8B016DF
PyModule_AddStringConstant.PYTHON312 ref: 00007FF8B8B016FE
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0171C
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0173A
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01758
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01776
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01794
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B017B2
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B017D0
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B017EE
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0180C
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0182A
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01848
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01866
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01884
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B018A2
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B018C0
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B018DE
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B018FC
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0191A
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01938
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01956
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01974
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01992
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B019B0
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B019CE
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B019EC
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01A0A
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01A28
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01A46
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01A64
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01A82
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01AA0
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01ABE
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01ADC
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01AFA
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01B18
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01B36
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01B54
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01B6F
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01B8A
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01BA8
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01BC6
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01BE4
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01C02
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01C20
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01C3E
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01C5C
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01C7A
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01C98
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01CB6
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01CD4
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01CF2
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01D10
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01D2E
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01D4C
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01D6A
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01D88
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01DA6
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01DC4
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01DE2
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01E00
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01E1E
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01E3C
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01E5A
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01E78
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01E96
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01EB4
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01ED2
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01EF0
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01F0E
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01F2C
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01F4A
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01F65
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01F83
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01FA1
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01FBF
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01FDD
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B01FFB
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02019
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02037
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02055
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02073
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02091
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B020AF
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B020CD
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B020EB
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02109
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02127
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02145
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02163
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02181
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0219F
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B021BD
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B021DB
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B021F9
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02217
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02235
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02253
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02271
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0228F
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B022AD
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B022CB
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B022E9
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02307
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02325
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02343
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02361
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0237F
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0239D
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B023BB
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B023D9
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B023F7
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02415
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02433
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02451
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0246F
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0248D
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B024AB
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B024C9
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B024E7
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02505
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02523
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02541
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0255F
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0257D
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0259B
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B025B9
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B025D7
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B025F5
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02613
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02631
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0264F
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0266D
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0268B
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B026A9
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B026C7
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B026E5
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02703
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02721
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0273F
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0275A
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02778
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02796
PyLong_FromUnsignedLong.PYTHON312 ref: 00007FF8B8B0280B
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B8B02826
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02861
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B0287F
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B02899
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8B8B028B3
PyErr_Format.PYTHON312 ref: 00007FF8B8B039BE
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B03A01
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B03A10

Strings

AF_LINK, xrefs: 00007FF8B8B014D0
IP_UNBLOCK_SOURCE, xrefs: 00007FF8B8B02195
BDADDR_ANY, xrefs: 00007FF8B8B016D8
90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD, xrefs: 00007FF8B8B01635
IPPROTO_ICMP, xrefs: 00007FF8B8B01B9E
RCVALL_SOCKETLEVELONLY, xrefs: 00007FF8B8B0288F
IPV6_MULTICAST_HOPS, xrefs: 00007FF8B8B02249
SO_ACCEPTCONN, xrefs: 00007FF8B8B017C6
IPV6_TCLASS, xrefs: 00007FF8B8B023CF
HV_PROTOCOL_RAW, xrefs: 00007FF8B8B01548
AI_CANONNAME, xrefs: 00007FF8B8B025CD
IPV6_RECVTCLASS, xrefs: 00007FF8B8B02393
IP_BLOCK_SOURCE, xrefs: 00007FF8B8B021B3
AI_NUMERICSERV, xrefs: 00007FF8B8B02609
INADDR_UNSPEC_GROUP, xrefs: 00007FF8B8B01FB5
TCP_KEEPCNT, xrefs: 00007FF8B8B02465
MSG_CTRUNC, xrefs: 00007FF8B8B01A5A
SO_DEBUG, xrefs: 00007FF8B8B017A8
A42E7CDA-D03F-480C-9CC2-A4DE20ABB878, xrefs: 00007FF8B8B01673
HVSOCKET_CONNECT_TIMEOUT, xrefs: 00007FF8B8B01566
SocketType, xrefs: 00007FF8B8B0136B
SO_TYPE, xrefs: 00007FF8B8B019A6
SOMAXCONN, xrefs: 00007FF8B8B019C4
HV_GUID_PARENT, xrefs: 00007FF8B8B0167D
SO_RCVBUF, xrefs: 00007FF8B8B018F2
SO_ERROR, xrefs: 00007FF8B8B01988
has_ipv6, xrefs: 00007FF8B8B0139E
IP_MULTICAST_IF, xrefs: 00007FF8B8B020E1
TCP_KEEPINTVL, xrefs: 00007FF8B8B02447
MSG_TRUNC, xrefs: 00007FF8B8B01A3C
IPPROTO_ROUTING, xrefs: 00007FF8B8B01CE8
herror, xrefs: 00007FF8B8B012A9
HVSOCKET_ADDRESS_FLAG_PASSTHRU, xrefs: 00007FF8B8B015C0
IP_DROP_SOURCE_MEMBERSHIP, xrefs: 00007FF8B8B021EF
TCP_NODELAY, xrefs: 00007FF8B8B023ED
socket.gaierror, xrefs: 00007FF8B8B012C8
IPPROTO_IPV4, xrefs: 00007FF8B8B01BF8
IPV6_UNICAST_HOPS, xrefs: 00007FF8B8B022A3
SO_RCVLOWAT, xrefs: 00007FF8B8B0192E
IPV6_LEAVE_GROUP, xrefs: 00007FF8B8B0222B
IP_TTL, xrefs: 00007FF8B8B02087
IPPROTO_TCP, xrefs: 00007FF8B8B01C34
SO_LINGER, xrefs: 00007FF8B8B01898
WSAStartup failed: network not ready, xrefs: 00007FF8B8B039CA
EAI_FAMILY, xrefs: 00007FF8B8B024FB
SO_BROADCAST, xrefs: 00007FF8B8B0185C
HV_GUID_LOOPBACK, xrefs: 00007FF8B8B0165E
IP_DROP_MEMBERSHIP, xrefs: 00007FF8B8B02159
SO_SNDBUF, xrefs: 00007FF8B8B018D4
SHUT_WR, xrefs: 00007FF8B8B0276E
SHUT_RDWR, xrefs: 00007FF8B8B0278C
HVSOCKET_CONNECTED_SUSPEND, xrefs: 00007FF8B8B015A2
SO_DONTROUTE, xrefs: 00007FF8B8B0183E
IP_OPTIONS, xrefs: 00007FF8B8B0202D
INADDR_ANY, xrefs: 00007FF8B8B01F5B
IPPROTO_ICLFXBM, xrefs: 00007FF8B8B01E32
IPPROTO_PIM, xrefs: 00007FF8B8B01DBA
IPV6_PKTINFO, xrefs: 00007FF8B8B02357
IPV6_MULTICAST_LOOP, xrefs: 00007FF8B8B02285
IPV6_MULTICAST_IF, xrefs: 00007FF8B8B02267
IPPROTO_ESP, xrefs: 00007FF8B8B01D24
IPV6_RECVRTHDR, xrefs: 00007FF8B8B02375
IPPROTO_DSTOPTS, xrefs: 00007FF8B8B01D9C
SOL_UDP, xrefs: 00007FF8B8B01B4A
SO_KEEPALIVE, xrefs: 00007FF8B8B01820
IPPORT_RESERVED, xrefs: 00007FF8B8B01F22
socket.herror, xrefs: 00007FF8B8B01277
IPPROTO_EGP, xrefs: 00007FF8B8B01C52
SOCK_RDM, xrefs: 00007FF8B8B0178A
SHUT_RD, xrefs: 00007FF8B8B02750
EAI_NONAME, xrefs: 00007FF8B8B02555
NI_NAMEREQD, xrefs: 00007FF8B8B026F9
_socket.CAPI, xrefs: 00007FF8B8B013D4
AI_PASSIVE, xrefs: 00007FF8B8B025AF
AI_V4MAPPED, xrefs: 00007FF8B8B02663
TCP_MAXSEG, xrefs: 00007FF8B8B0240B
AI_ALL, xrefs: 00007FF8B8B02627
NI_NOFQDN, xrefs: 00007FF8B8B026BD
SIO_LOOPBACK_FAST_PATH, xrefs: 00007FF8B8B027E8
MSG_MCAST, xrefs: 00007FF8B8B01AD2
AF_UNSPEC, xrefs: 00007FF8B8B0141C
gaierror, xrefs: 00007FF8B8B012EB
SOCK_SEQPACKET, xrefs: 00007FF8B8B0176C
MSG_DONTROUTE, xrefs: 00007FF8B8B01A1E
INADDR_ALLHOSTS_GROUP, xrefs: 00007FF8B8B01FD3
MSG_WAITALL, xrefs: 00007FF8B8B01A78
error, xrefs: 00007FF8B8B0130A
IPPROTO_FRAGMENT, xrefs: 00007FF8B8B01D06
HV_GUID_CHILDREN, xrefs: 00007FF8B8B0163F
MSG_OOB, xrefs: 00007FF8B8B019E2
MSG_PEEK, xrefs: 00007FF8B8B01A00
AF_SNA, xrefs: 00007FF8B8B014EE
timeout, xrefs: 00007FF8B8B0132C
WSAStartup failed: requested version not supported, xrefs: 00007FF8B8B039D3
EAI_SERVICE, xrefs: 00007FF8B8B02573
INADDR_NONE, xrefs: 00007FF8B8B0200F
SO_OOBINLINE, xrefs: 00007FF8B8B018B6
EAI_NODATA, xrefs: 00007FF8B8B02537
AF_HYPERV, xrefs: 00007FF8B8B0152A
BTPROTO_RFCOMM, xrefs: 00007FF8B8B016B6
SO_EXCLUSIVEADDRUSE, xrefs: 00007FF8B8B01802
EAI_AGAIN, xrefs: 00007FF8B8B024A1
AF_DECnet, xrefs: 00007FF8B8B014B2
NI_MAXSERV, xrefs: 00007FF8B8B0269F
IP_MULTICAST_LOOP, xrefs: 00007FF8B8B0211D
MSG_BCAST, xrefs: 00007FF8B8B01AB4
IPV6_V6ONLY, xrefs: 00007FF8B8B022C1
IPV6_RTHDR, xrefs: 00007FF8B8B023B1
IPPROTO_IP, xrefs: 00007FF8B8B01B65
EAI_BADFLAGS, xrefs: 00007FF8B8B024BF
SO_RCVTIMEO, xrefs: 00007FF8B8B0196A
SO_USELOOPBACK, xrefs: 00007FF8B8B0187A
SOCK_STREAM, xrefs: 00007FF8B8B01712
IPPROTO_IGP, xrefs: 00007FF8B8B01E8C
EAI_FAIL, xrefs: 00007FF8B8B024DD
IPPROTO_PGM, xrefs: 00007FF8B8B01EC8
SIO_KEEPALIVE_VALS, xrefs: 00007FF8B8B027C6
IPPROTO_GGP, xrefs: 00007FF8B8B01BDA
E0E16197-DD56-4A10-9195-5EE7A155A838, xrefs: 00007FF8B8B01654
IPPROTO_RDP, xrefs: 00007FF8B8B01EAA
SOCK_DGRAM, xrefs: 00007FF8B8B01730
EAI_SOCKTYPE, xrefs: 00007FF8B8B02591
IPPROTO_AH, xrefs: 00007FF8B8B01D42
IPV6_JOIN_GROUP, xrefs: 00007FF8B8B0220D
IPV6_DONTFRAG, xrefs: 00007FF8B8B022FD
SIO_RCVALL, xrefs: 00007FF8B8B027A4
FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF, xrefs: 00007FF8B8B01616
IPPROTO_L2TP, xrefs: 00007FF8B8B01EE6
HV_GUID_WILDCARD, xrefs: 00007FF8B8B01601
HV_GUID_BROADCAST, xrefs: 00007FF8B8B01620
IP_TOS, xrefs: 00007FF8B8B02069
IPPROTO_ND, xrefs: 00007FF8B8B01CCA
SO_SNDLOWAT, xrefs: 00007FF8B8B01910
IPPROTO_UDP, xrefs: 00007FF8B8B01C8E
SOCK_RAW, xrefs: 00007FF8B8B0174E
AF_IRDA, xrefs: 00007FF8B8B0150C
00:00:00:FF:FF:FF, xrefs: 00007FF8B8B016ED
BDADDR_LOCAL, xrefs: 00007FF8B8B016F7
IPV6_CHECKSUM, xrefs: 00007FF8B8B022DF
MSG_ERRQUEUE, xrefs: 00007FF8B8B01A96
RCVALL_ON, xrefs: 00007FF8B8B02875
WSAStartup failed: error code %d, xrefs: 00007FF8B8B039B1
TCP_FASTOPEN, xrefs: 00007FF8B8B02483
HV_GUID_ZERO, xrefs: 00007FF8B8B015E2
IP_PKTINFO, xrefs: 00007FF8B8B02177
AF_IPX, xrefs: 00007FF8B8B01458
IPPROTO_MAX, xrefs: 00007FF8B8B01E14
TCP_KEEPIDLE, xrefs: 00007FF8B8B02429
NI_DGRAM, xrefs: 00007FF8B8B02735
NI_NUMERICSERV, xrefs: 00007FF8B8B02717
INADDR_LOOPBACK, xrefs: 00007FF8B8B01F97
SO_REUSEADDR, xrefs: 00007FF8B8B017E4
AF_BLUETOOTH, xrefs: 00007FF8B8B01698
AI_NUMERICHOST, xrefs: 00007FF8B8B025EB
RCVALL_MAX, xrefs: 00007FF8B8B028A9
INADDR_BROADCAST, xrefs: 00007FF8B8B01F79
IPPROTO_CBT, xrefs: 00007FF8B8B01E6E
IPPROTO_SCTP, xrefs: 00007FF8B8B01DD8, 00007FF8B8B01F04
IPPORT_USERRESERVED, xrefs: 00007FF8B8B01F40
AF_INET, xrefs: 00007FF8B8B0143A
RCVALL_OFF, xrefs: 00007FF8B8B02857
NI_MAXHOST, xrefs: 00007FF8B8B02681
IPPROTO_HOPOPTS, xrefs: 00007FF8B8B01B80
CAPI, xrefs: 00007FF8B8B013F0
IP_HDRINCL, xrefs: 00007FF8B8B0204B
IPPROTO_PUP, xrefs: 00007FF8B8B01C70
IP_RECVDSTADDR, xrefs: 00007FF8B8B020C3
EAI_MEMORY, xrefs: 00007FF8B8B02519
AI_ADDRCONFIG, xrefs: 00007FF8B8B02645
INADDR_MAX_LOCAL_GROUP, xrefs: 00007FF8B8B01FF1
IPPROTO_ICMPV6, xrefs: 00007FF8B8B01D60
SOL_SOCKET, xrefs: 00007FF8B8B01AF0
SOL_IP, xrefs: 00007FF8B8B01B0E
IP_RECVTOS, xrefs: 00007FF8B8B020A5
IP_ADD_MEMBERSHIP, xrefs: 00007FF8B8B0213B
SOL_TCP, xrefs: 00007FF8B8B01B2C
AF_INET6, xrefs: 00007FF8B8B01494
IPPROTO_IDP, xrefs: 00007FF8B8B01CAC
00:00:00:00:00:00, xrefs: 00007FF8B8B016CE
IPV6_HOPLIMIT, xrefs: 00007FF8B8B0231B
IP_MULTICAST_TTL, xrefs: 00007FF8B8B020FF
IP_ADD_SOURCE_MEMBERSHIP, xrefs: 00007FF8B8B021D1
00000000-0000-0000-0000-000000000000, xrefs: 00007FF8B8B015D8, 00007FF8B8B015F7
IPPROTO_IPV6, xrefs: 00007FF8B8B01C16
AF_APPLETALK, xrefs: 00007FF8B8B01476
IPPROTO_NONE, xrefs: 00007FF8B8B01D7E
IPV6_HOPOPTS, xrefs: 00007FF8B8B02339
IPPROTO_RAW, xrefs: 00007FF8B8B01DF6
NI_NUMERICHOST, xrefs: 00007FF8B8B026DB
IPPROTO_IGMP, xrefs: 00007FF8B8B01BBC
IPPROTO_ST, xrefs: 00007FF8B8B01E50
SO_SNDTIMEO, xrefs: 00007FF8B8B0194C
HVSOCKET_CONNECT_TIMEOUT_MAX, xrefs: 00007FF8B8B01584

Memory Dump Source

Source File: 00000002.00000002.3308593902.00007FF8B8B01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B8B00000, based on PE: true

Associated: 00000002.00000002.3308574801.00007FF8B8B00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308615266.00007FF8B8B09000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308675038.00007FF8B8B11000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308694750.00007FF8B8B13000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8b00000_0jNz7djbpp.jbxd

Similarity

API ID: Module_$Constant$ObjectString$Err_$DeallocExceptionFrom$Capsule_ExitFormatLongLong_MallocMem_MetaclassStartupTypeType_Unsigned
String ID: 00000000-0000-0000-0000-000000000000$00:00:00:00:00:00$00:00:00:FF:FF:FF$90DB8B89-0D35-4F79-8CE9-49EA0AC8B7CD$A42E7CDA-D03F-480C-9CC2-A4DE20ABB878$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_HYPERV$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$E0E16197-DD56-4A10-9195-5EE7A155A838$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF$HVSOCKET_ADDRESS_FLAG_PASSTHRU$HVSOCKET_CONNECTED_SUSPEND$HVSOCKET_CONNECT_TIMEOUT$HVSOCKET_CONNECT_TIMEOUT_MAX$HV_GUID_BROADCAST$HV_GUID_CHILDREN$HV_GUID_LOOPBACK$HV_GUID_PARENT$HV_GUID_WILDCARD$HV_GUID_ZERO$HV_PROTOCOL_RAW$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_ADD_SOURCE_MEMBERSHIP$IP_BLOCK_SOURCE$IP_DROP_MEMBERSHIP$IP_DROP_SOURCE_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_PKTINFO$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$IP_UNBLOCK_SOURCE$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket.gaierror$socket.herror$timeout
API String ID: 585143114-1188461360
Opcode ID: 7ce75d0e8ce51beaa5017a69f1cafd12c0347cf952baad51f27e7ce9e03ee791
Instruction ID: 22edfd265d3111ff30cbce83b8ab877a4bfe2ff4d10dad3a270faea2c8c4b959
Opcode Fuzzy Hash: 7ce75d0e8ce51beaa5017a69f1cafd12c0347cf952baad51f27e7ce9e03ee791
Instruction Fuzzy Hash: 92C2C464F18B5781F6129B3EA8542653794BF45BC1F409036CB0EA66B5EF6DF20AE308

Function 00007FF8A81B1A0F Relevance: 149.6, APIs: 77, Strings: 8, Instructions: 892COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FA5E3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FA5FB
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FA790
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FA7A8
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FF8A81FA896
EVP_CIPHER_get_flags.LIBCRYPTO-3 ref: 00007FF8A81FA89E
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FA8CF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FA8E7
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FAA56
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FAA6E
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FB399
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FB3B1
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FB3C3
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FB3CF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FB3E7

Strings

POST , xrefs: 00007FF8A81FB290
HEAD , xrefs: 00007FF8A81FB2AE
CONNE, xrefs: 00007FF8A81FB2DD
, xrefs: 00007FF8A81FAA4C
..\s\ssl\record\ssl3_record.c, xrefs: 00007FF8A81FA5F4, 00007FF8A81FA7A1, 00007FF8A81FA8E0, 00007FF8A81FA930, 00007FF8A81FA960, 00007FF8A81FA98D, 00007FF8A81FA9BA, 00007FF8A81FAA67, 00007FF8A81FAAB0, 00007FF8A81FAC05, 00007FF8A81FAC2D, 00007FF8A81FAC64, 00007FF8A81FAC99, 00007FF8A81FAD23, 00007FF8A81FAE33, 00007FF8A81FB001, 00007FF8A81FB090, 00007FF8A81FB0B2, 00007FF8A81FB0D7, 00007FF8A81FB10C, 00007FF8A81FB141, 00007FF8A81FB178, 00007FF8A81FB1AF, 00007FF8A81FB1E6, 00007FF8A81FB21B, 00007FF8A81FB302, 00007FF8A81FB33C, 00007FF8A81FB3AA, 00007FF8A81FB3E0
PUT , xrefs: 00007FF8A81FB2C9
ssl3_get_record, xrefs: 00007FF8A81FA5ED, 00007FF8A81FA79A, 00007FF8A81FA8D9, 00007FF8A81FA929, 00007FF8A81FA959, 00007FF8A81FA981, 00007FF8A81FA9AE, 00007FF8A81FAA5B, 00007FF8A81FAAA4, 00007FF8A81FABF9, 00007FF8A81FAC21, 00007FF8A81FAC8D, 00007FF8A81FAD17, 00007FF8A81FAE27, 00007FF8A81FAFF5, 00007FF8A81FB0CB, 00007FF8A81FB100, 00007FF8A81FB135, 00007FF8A81FB16C, 00007FF8A81FB1A3, 00007FF8A81FB1DA, 00007FF8A81FB20F, 00007FF8A81FB2F6, 00007FF8A81FB330, 00007FF8A81FB3A3, 00007FF8A81FB3D4
GET , xrefs: 00007FF8A81FB26D

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_new$R_set_debug$R_get_flagsX_get0_cipher
String ID: $..\s\ssl\record\ssl3_record.c$CONNE$GET $HEAD $POST $PUT $ssl3_get_record
API String ID: 1830453883-2781224710
Opcode ID: 5844f7621a1cbe1188d8689772c9c6c5490e683883325f7f9fc13d7db788595b
Instruction ID: b44c7b10ff93c72af0cf5933c5fb41e503c0f9694e3eb67bb2b321ddabc4be09
Opcode Fuzzy Hash: 5844f7621a1cbe1188d8689772c9c6c5490e683883325f7f9fc13d7db788595b
Instruction Fuzzy Hash: 3992AE71A0E682A6FB21DB21D8457B923A0FF847C8F544032DA4E47699DF7CE885C738

Function 00007FF8A81F5770 Relevance: 65.6, APIs: 34, Strings: 3, Instructions: 827COMMON

Download Yara Rule

APIs

EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FF8A81F592A
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FF8A81F593B
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8A81F5943
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F5950
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F5968
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F5A1E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F5A36
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F5B22
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F5B3A
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FF8A81F5C8E
EVP_CIPHER_get_mode.LIBCRYPTO-3 ref: 00007FF8A81F5C96
EVP_CIPHER_CTX_get_iv_length.LIBCRYPTO-3 ref: 00007FF8A81F5CA5
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F5CAE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F5CC6
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F5CD6
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F6451
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F6462
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F647C
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F6488
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F6494
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F64AC

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8A81F5961, 00007FF8A81F5A2F, 00007FF8A81F5B33, 00007FF8A81F5B6F, 00007FF8A81F5CBF, 00007FF8A81F5F03, 00007FF8A81F64A5
U, xrefs: 00007FF8A81F5A16
do_ssl3_write, xrefs: 00007FF8A81F5955, 00007FF8A81F5A23, 00007FF8A81F5B27, 00007FF8A81F5B63, 00007FF8A81F5CB3, 00007FF8A81F5EF7, 00007FF8A81F649E

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_new$R_set_debug$X_get0_md$D_get_sizeR_get_modeX_get0_cipherX_get_iv_length
String ID: ..\s\ssl\record\rec_layer_s3.c$U$do_ssl3_write
API String ID: 2155623385-3398879041
Opcode ID: bca7e7fb3376a335542f5993ff9c45827a35be7171bdc2aead283071b174c52e
Instruction ID: 97d5dead8ed3915938da07c35d26d9d2e6cfcf1a5ff36701558c80c84dc7297a
Opcode Fuzzy Hash: bca7e7fb3376a335542f5993ff9c45827a35be7171bdc2aead283071b174c52e
Instruction Fuzzy Hash: 1772BD72A0A682A6FB219B21D5447FD23A4FB85BC8F540136DE4D47789DFBCE844C728

Function 00007FF8B78A8CAC Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 171
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyWeakref_GetObject.PYTHON312 ref: 00007FF8B78A8CD8
SSL_get_rbio.LIBSSL-3 ref: 00007FF8B78A8D37
BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8B78A8D4C
SSL_get_wbio.LIBSSL-3 ref: 00007FF8B78A8D56
BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8B78A8D67
_PyDeadline_Init.PYTHON312 ref: 00007FF8B78A8D82

Part of subcall function 00007FF8B78A6554: ERR_peek_last_error.LIBCRYPTO-3 ref: 00007FF8B78A656C
Part of subcall function 00007FF8B78A6554: ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8B78A6595

PyEval_SaveThread.PYTHON312 ref: 00007FF8B78A8D9B
SSL_do_handshake.LIBSSL-3 ref: 00007FF8B78A8DA8
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B78A8DE7
PyErr_CheckSignals.PYTHON312 ref: 00007FF8B78A8DFE
_PyDeadline_Get.PYTHON312 ref: 00007FF8B78A8E16
_Py_Dealloc.PYTHON312 ref: 00007FF8B78A8E76
PyErr_SetString.PYTHON312 ref: 00007FF8B78A8EC7
_Py_Dealloc.PYTHON312 ref: 00007FF8B78A8EDF

Strings

_ssl.c:987: Underlying socket has been closed., xrefs: 00007FF8B78A8EA1
_ssl.c:991: Underlying socket too large for select()., xrefs: 00007FF8B78A8E98
_ssl.c:983: The handshake operation timed out, xrefs: 00007FF8B78A8EBD
Underlying socket connection gone, xrefs: 00007FF8B78A8D02

Memory Dump Source

Source File: 00000002.00000002.3307994633.00007FF8B78A1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B78A0000, based on PE: true

Associated: 00000002.00000002.3307937546.00007FF8B78A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308015574.00007FF8B78AD000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308042923.00007FF8B78C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308061879.00007FF8B78C1000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308135419.00007FF8B78C7000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308176623.00007FF8B78C9000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b78a0000_0jNz7djbpp.jbxd

Similarity

API ID: Deadline_DeallocErr_Eval_O_ctrlThread$CheckInitL_do_handshakeL_get_rbioL_get_wbioObjectR_clear_errorR_peek_last_errorRestoreSaveSignalsStringWeakref_
String ID: Underlying socket connection gone$_ssl.c:983: The handshake operation timed out$_ssl.c:987: Underlying socket has been closed.$_ssl.c:991: Underlying socket too large for select().
API String ID: 3614085790-1145532335
Opcode ID: fe373fa390acac4dba2bf3258ca8a1411e2591c0ac4994f360803510e032e358
Instruction ID: f0e40d4b50419e006219def7de7b62abc1caaecc68da014642238363c6a5d949
Opcode Fuzzy Hash: fe373fa390acac4dba2bf3258ca8a1411e2591c0ac4994f360803510e032e358
Instruction Fuzzy Hash: C6617D21B08B4286EB619F2AA84457D6BA1BF99BC4F104431DF0E97B74DF3DE452D328

Function 00007FF8A81B1F87 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81F8C86
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8A81F8CA5
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F8CF7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F8D0F

Strings

ssl3_setup_write_buffer, xrefs: 00007FF8A81F8CFC
..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FF8A81F8C79, 00007FF8A81F8C9B, 00007FF8A81F8D08

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_freeO_mallocR_newR_set_debug
String ID: ..\s\ssl\record\ssl3_buffer.c$ssl3_setup_write_buffer
API String ID: 1940814937-2966149938
Opcode ID: 85afb77f46bc72fdc1d4914c7653f89f6487480f5dafdb57c33bc1f02508be0d
Instruction ID: de41bb76106dc81fc7b244a6ba49f11b26df1e5bfc0b779e9f1b7f88ceb7f410
Opcode Fuzzy Hash: 85afb77f46bc72fdc1d4914c7653f89f6487480f5dafdb57c33bc1f02508be0d
Instruction Fuzzy Hash: E231CE73A0AB41A1FB11EB21E8403AA32A4FB44BC4F194531DE8D17B89DF7CD951C368

Function 00007FF8B8B05074 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47threadnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B8B03D80: PyErr_Format.PYTHON312 ref: 00007FF8B8B04102

PySys_Audit.PYTHON312 ref: 00007FF8B8B050CC
PyEval_SaveThread.PYTHON312 ref: 00007FF8B8B050DE
bind.WS2_32 ref: 00007FF8B8B050F5
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8B05100

Strings

socket.bind, xrefs: 00007FF8B8B050C5
bind, xrefs: 00007FF8B8B05093

Memory Dump Source

Source File: 00000002.00000002.3308593902.00007FF8B8B01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B8B00000, based on PE: true

Associated: 00000002.00000002.3308574801.00007FF8B8B00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308615266.00007FF8B8B09000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308675038.00007FF8B8B11000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308694750.00007FF8B8B13000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8b00000_0jNz7djbpp.jbxd

Similarity

API ID: Eval_Thread$AuditErr_FormatRestoreSaveSys_bind
String ID: bind$socket.bind
API String ID: 1695574521-187351271
Opcode ID: 77259c4cc41cffc2c3f1a4c23cf7c52fadd24801fbce19dc13b5509f2f44b2df
Instruction ID: 464317b52b301ace0f713ef4602e09cef74fdbbeafaebc358fdb51ccb7248bdb
Opcode Fuzzy Hash: 77259c4cc41cffc2c3f1a4c23cf7c52fadd24801fbce19dc13b5509f2f44b2df
Instruction Fuzzy Hash: 58112C21A1CB8681EA209B39F8447AA7364FF48BC4F441132DB8D67B64DF3CE5068708

Function 00007FF8B8CB10E0 Relevance: 80.8, APIs: 34, Strings: 12, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyImport_ImportModule.PYTHON312 ref: 00007FF8B8CB1114

Strings

SO_UPDATE_CONNECT_CONTEXT, xrefs: 00007FF8B8CB154E
ERROR_PIPE_BUSY, xrefs: 00007FF8B8CB1432
SO_UPDATE_ACCEPT_CONTEXT, xrefs: 00007FF8B8CB1515
NULL, xrefs: 00007FF8B8CB14DC
TF_REUSE_SOCKET, xrefs: 00007FF8B8CB1587
ERROR_NETNAME_DELETED, xrefs: 00007FF8B8CB1387
_socket, xrefs: 00007FF8B8CB110D
ERROR_OPERATION_ABORTED, xrefs: 00007FF8B8CB13C0
ERROR_IO_PENDING, xrefs: 00007FF8B8CB134E
INVALID_HANDLE_VALUE, xrefs: 00007FF8B8CB14A6
ERROR_SEM_TIMEOUT, xrefs: 00007FF8B8CB13F9
INFINITE, xrefs: 00007FF8B8CB146B

Memory Dump Source

Source File: 00000002.00000002.3309145812.00007FF8B8CB1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B8CB0000, based on PE: true

Associated: 00000002.00000002.3309123846.00007FF8B8CB0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.3309185509.00007FF8B8CB6000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.3309205030.00007FF8B8CBA000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.3309222046.00007FF8B8CBB000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8cb0000_0jNz7djbpp.jbxd

Similarity

API ID: ImportImport_Module
String ID: ERROR_IO_PENDING$ERROR_NETNAME_DELETED$ERROR_OPERATION_ABORTED$ERROR_PIPE_BUSY$ERROR_SEM_TIMEOUT$INFINITE$INVALID_HANDLE_VALUE$NULL$SO_UPDATE_ACCEPT_CONTEXT$SO_UPDATE_CONNECT_CONTEXT$TF_REUSE_SOCKET$_socket
API String ID: 412506365-2369917753
Opcode ID: 3ce81b8e5d00c5987ad43871f43d288b58179398d8ef34d083f58b447e6828ed
Instruction ID: 336a5e4c94ac6bda3afc452b1504f6cfc6ee401dcd1dec3b9cf1bfd641292dfb
Opcode Fuzzy Hash: 3ce81b8e5d00c5987ad43871f43d288b58179398d8ef34d083f58b447e6828ed
Instruction Fuzzy Hash: AFD14EA1A19F0A8EEB908F18E86867533A0EF45BD4F441535DB4E47794EF3CE7068748

Function 00007FF8B7DE1560 Relevance: 78.9, APIs: 25, Strings: 20, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyImport_ImportModule.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1579
PyDict_New.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE158C
PySet_New.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE15A1
Py_BuildValue.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE15C2
PyImport_ImportModule.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE15DC
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE15F8
PyImport_ImportModule.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1621
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE163D
_Py_Dealloc.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE29CE

Strings

asyncio.exceptions, xrefs: 00007FF8B7DE165F
iscoroutine, xrefs: 00007FF8B7DE175C
context, xrefs: 00007FF8B7DE15B4
WeakSet, xrefs: 00007FF8B7DE17EC
_task_print_stack, xrefs: 00007FF8B7DE1717
InvalidStateError, xrefs: 00007FF8B7DE1678
extract_stack, xrefs: 00007FF8B7DE17A4
_future_repr, xrefs: 00007FF8B7DE1633
get_event_loop_policy, xrefs: 00007FF8B7DE15EE
asyncio, xrefs: 00007FF8B7DE1572
asyncio.base_tasks, xrefs: 00007FF8B7DE16C1
CancelledError, xrefs: 00007FF8B7DE1695
_task_get_stack, xrefs: 00007FF8B7DE16FA
_task_repr, xrefs: 00007FF8B7DE16DA
asyncio.base_futures, xrefs: 00007FF8B7DE161A
asyncio.events, xrefs: 00007FF8B7DE15D5
weakref, xrefs: 00007FF8B7DE17D3
(s), xrefs: 00007FF8B7DE15BB
asyncio.coroutines, xrefs: 00007FF8B7DE1743
traceback, xrefs: 00007FF8B7DE178B

Memory Dump Source

Source File: 00000002.00000002.3308215869.00007FF8B7DE1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8B7DE0000, based on PE: true

Associated: 00000002.00000002.3308198035.00007FF8B7DE0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308274889.00007FF8B7DE8000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308295511.00007FF8B7DED000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308355103.00007FF8B7DEF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7de0000_0jNz7djbpp.jbxd

Similarity

API ID: ImportImport_Module$AttrObject_String$BuildDeallocDict_Set_Value
String ID: (s)$CancelledError$InvalidStateError$WeakSet$_future_repr$_task_get_stack$_task_print_stack$_task_repr$asyncio$asyncio.base_futures$asyncio.base_tasks$asyncio.coroutines$asyncio.events$asyncio.exceptions$context$extract_stack$get_event_loop_policy$iscoroutine$traceback$weakref
API String ID: 619080988-694597896
Opcode ID: 107a669166a15369aede0d84b43ceceb422bf509d1b4bf3cb273ae2fe6a8dfbc
Instruction ID: 1aff4d6f2f7ad140ed9814219f6733c693b3a876605b7b1bbd900039b7f443a1
Opcode Fuzzy Hash: 107a669166a15369aede0d84b43ceceb422bf509d1b4bf3cb273ae2fe6a8dfbc
Instruction Fuzzy Hash: D191A625B09F0391FE5B8B19A85427C22A0AF087D5F4C2635CB6E627B8EF3CF5958311

Function 00007FF8A81B1C1C Relevance: 70.6, APIs: 37, Strings: 3, Instructions: 617COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F6A29
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F6C60
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F6C78
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F73E3

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8A81F6C71, 00007FF8A81F6DEF, 00007FF8A81F6FD6, 00007FF8A81F7112, 00007FF8A81F713F, 00007FF8A81F7177, 00007FF8A81F71B1, 00007FF8A81F7212, 00007FF8A81F723F, 00007FF8A81F72A8, 00007FF8A81F72D5, 00007FF8A81F731D, 00007FF8A81F7344, 00007FF8A81F73DC
SSL alert number %d, xrefs: 00007FF8A81F71C8
ssl3_read_bytes, xrefs: 00007FF8A81F6C65, 00007FF8A81F6DE3, 00007FF8A81F6FCA, 00007FF8A81F7106, 00007FF8A81F7133, 00007FF8A81F716B, 00007FF8A81F71A5, 00007FF8A81F7206, 00007FF8A81F7233, 00007FF8A81F729C, 00007FF8A81F72CE, 00007FF8A81F7311, 00007FF8A81F733D, 00007FF8A81F73D5

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\record\rec_layer_s3.c$SSL alert number %d$ssl3_read_bytes
API String ID: 193678381-3615793073
Opcode ID: 381c6c421e8021476aeda6a916ac96ac20e7bda4ea2bb99a447231b109823cd9
Instruction ID: 11477e628e61ff377f68b8e0c7f472b0ba1806210b6d47deabcfe3de5d28b18a
Opcode Fuzzy Hash: 381c6c421e8021476aeda6a916ac96ac20e7bda4ea2bb99a447231b109823cd9
Instruction Fuzzy Hash: B752B231A0E682A5FB668B11D4403BE3791EF817C4F94453ACE8E07699DF7DE885C728

Function 00007FF8B8B070C0 Relevance: 54.5, APIs: 24, Strings: 7, Instructions: 260
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON312 ref: 00007FF8B8B0715C
PyUnicode_AsEncodedString.PYTHON312 ref: 00007FF8B8B07196
PyObject_Str.PYTHON312 ref: 00007FF8B8B071D9
PyUnicode_AsUTF8.PYTHON312 ref: 00007FF8B8B071FF
PySys_Audit.PYTHON312 ref: 00007FF8B8B0725D
PyEval_SaveThread.PYTHON312 ref: 00007FF8B8B07293
getaddrinfo.WS2_32 ref: 00007FF8B8B072AA
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8B072B6
PyList_New.PYTHON312 ref: 00007FF8B8B072D8
_Py_BuildValue_SizeT.PYTHON312 ref: 00007FF8B8B07343
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B0735D
PyList_Append.PYTHON312 ref: 00007FF8B8B07372
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B0738B
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B073B1
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B073CA
freeaddrinfo.WS2_32 ref: 00007FF8B8B073D9
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B073F4
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B07409
PyErr_SetString.PYTHON312 ref: 00007FF8B8B07422
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B0743B
_Py_Dealloc.PYTHON312 ref: 00007FF8B8B07454
freeaddrinfo.WS2_32 ref: 00007FF8B8B07463
PyErr_SetString.PYTHON312 ref: 00007FF8B8B0747C

Strings

OO|iiii:getaddrinfo, xrefs: 00007FF8B8B07110
idna, xrefs: 00007FF8B8B0718F
OOiii, xrefs: 00007FF8B8B0723A
getaddrinfo() argument 1 must be string or None, xrefs: 00007FF8B8B07472
socket.getaddrinfo, xrefs: 00007FF8B8B0724B
iiisO, xrefs: 00007FF8B8B07338
Int or String expected, xrefs: 00007FF8B8B07418

Memory Dump Source

Source File: 00000002.00000002.3308593902.00007FF8B8B01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B8B00000, based on PE: true

Associated: 00000002.00000002.3308574801.00007FF8B8B00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308615266.00007FF8B8B09000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308675038.00007FF8B8B11000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308694750.00007FF8B8B13000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8b00000_0jNz7djbpp.jbxd

Similarity

API ID: Dealloc$String$Err_Eval_List_SizeThreadUnicode_freeaddrinfo$AppendArg_AuditBuildEncodedKeywords_Object_ParseRestoreSaveSys_TupleValue_getaddrinfo
String ID: Int or String expected$OOiii$OO|iiii:getaddrinfo$getaddrinfo() argument 1 must be string or None$idna$iiisO$socket.getaddrinfo
API String ID: 3469260611-1074899869
Opcode ID: 23be9308df294b3ceca43b4538df3c03a2cd0e723b85bf30aa3f47610af3ade2
Instruction ID: c9e823018b1ee63df8ae9599a6ad7659cda12efbc62d97a2dab85b120c1c14a2
Opcode Fuzzy Hash: 23be9308df294b3ceca43b4538df3c03a2cd0e723b85bf30aa3f47610af3ade2
Instruction Fuzzy Hash: 8CC12332A09A02C6EB14CF79E8546BCB7A4BB48BC4F408535DF4E66A64DF3DE546C708

Function 00007FF8B78A82CC Relevance: 47.4, APIs: 22, Strings: 5, Instructions: 195
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B78A8305
PyErr_SetString.PYTHON312 ref: 00007FF8B78A834F
PyUnicode_FSConverter.PYTHON312 ref: 00007FF8B78A8361
PyErr_ExceptionMatches.PYTHON312 ref: 00007FF8B78A8375
PyUnicode_FSConverter.PYTHON312 ref: 00007FF8B78A8398
PyErr_ExceptionMatches.PYTHON312 ref: 00007FF8B78A83AC
PyUnicode_AsASCIIString.PYTHON312 ref: 00007FF8B78A83DB
PyErr_ExceptionMatches.PYTHON312 ref: 00007FF8B78A83F3
_Py_Dealloc.PYTHON312 ref: 00007FF8B78A8430
PyObject_CheckBuffer.PYTHON312 ref: 00007FF8B78A845A
PyObject_GetBuffer.PYTHON312 ref: 00007FF8B78A846E
PyBuffer_IsContiguous.PYTHON312 ref: 00007FF8B78A8482
PyBuffer_Release.PYTHON312 ref: 00007FF8B78A84AD
PyBuffer_Release.PYTHON312 ref: 00007FF8B78A84C2
PyEval_SaveThread.PYTHON312 ref: 00007FF8B78A84E9
SSL_CTX_load_verify_locations.LIBSSL-3 ref: 00007FF8B78A84FC
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B78A8507
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B78A8511
PyErr_SetFromErrno.PYTHON312 ref: 00007FF8B78A8526
ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8B78A852C
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,00007FF8A8CF2C90,?,?,00007FF8A8CF2C90,?,00007FF8A8CF2C90,00007FF8B78A82AC), ref: 00007FF8B78A8560
_Py_Dealloc.PYTHON312 ref: 00007FF8B78A857A

Strings

cafile, capath and cadata cannot be all omitted, xrefs: 00007FF8B78A833E
capath should be a valid filesystem path, xrefs: 00007FF8B78A83BA
cadata should be an ASCII string or a bytes-like object, xrefs: 00007FF8B78A8401
cafile should be a valid filesystem path, xrefs: 00007FF8B78A8383
cadata should be a contiguous buffer with a single dimension, xrefs: 00007FF8B78A84C8

Memory Dump Source

Source File: 00000002.00000002.3307994633.00007FF8B78A1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B78A0000, based on PE: true

Associated: 00000002.00000002.3307937546.00007FF8B78A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308015574.00007FF8B78AD000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308042923.00007FF8B78C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308061879.00007FF8B78C1000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308135419.00007FF8B78C7000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308176623.00007FF8B78C9000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b78a0000_0jNz7djbpp.jbxd

Similarity

API ID: Err_$Buffer_DeallocExceptionMatchesUnicode_$BufferConverterEval_Object_ReleaseStringThread_errno$CheckContiguousErrnoFromR_clear_errorRestoreSaveX_load_verify_locations
String ID: cadata should be a contiguous buffer with a single dimension$cadata should be an ASCII string or a bytes-like object$cafile should be a valid filesystem path$cafile, capath and cadata cannot be all omitted$capath should be a valid filesystem path
API String ID: 3554890122-3904065072
Opcode ID: 7c0e50c5d797ef638d39eef09b1b159086aa94cba534aa7ea738b7df414c95bc
Instruction ID: c08372a9289046defc3de3fd6e4bade38a79065fc9fd16f888cc4bf103b843bb
Opcode Fuzzy Hash: 7c0e50c5d797ef638d39eef09b1b159086aa94cba534aa7ea738b7df414c95bc
Instruction Fuzzy Hash: A8814A61F09B0285EB569B6EE8542BD2BA2BF44BD4F444031CF0E976B8DE7CE445D328

Function 00007FF8B8B05AB0 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 234
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FF8B8B05AF4
PySys_Audit.PYTHON312 ref: 00007FF8B8B05B2C
PyErr_Format.PYTHON312 ref: 00007FF8B8B05B84
PySys_Audit.PYTHON312 ref: 00007FF8B8B05C82
PyEval_SaveThread.PYTHON312 ref: 00007FF8B8B05C90
WSASocketW.WS2_32 ref: 00007FF8B8B05CBC
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8B05CC8
SetHandleInformation.KERNEL32 ref: 00007FF8B8B05CE6
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FF8B8B05CF2
closesocket.WS2_32 ref: 00007FF8B8B05CFB
PyLong_AsLongLong.PYTHON312 ref: 00007FF8B8B05D25
PyErr_Occurred.PYTHON312 ref: 00007FF8B8B05D34
PyErr_SetString.PYTHON312 ref: 00007FF8B8B05D54
memset.VCRUNTIME140 ref: 00007FF8B8B05D74
getsockname.WS2_32 ref: 00007FF8B8B05D86
WSAGetLastError.WS2_32 ref: 00007FF8B8B05DA5
getsockopt.WS2_32 ref: 00007FF8B8B05DE2
PyEval_SaveThread.PYTHON312 ref: 00007FF8B8B05E23
WSASocketW.WS2_32 ref: 00007FF8B8B05E44
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8B05E50

Strings

negative file descriptor, xrefs: 00007FF8B8B05D4A
socket.__new__, xrefs: 00007FF8B8B05B25, 00007FF8B8B05C1D
socket descriptor string has wrong size, should be %zu bytes., xrefs: 00007FF8B8B05B74
Oiii, xrefs: 00007FF8B8B05B13, 00007FF8B8B05C5D

Memory Dump Source

Source File: 00000002.00000002.3308593902.00007FF8B8B01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B8B00000, based on PE: true

Associated: 00000002.00000002.3308574801.00007FF8B8B00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308615266.00007FF8B8B09000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308675038.00007FF8B8B11000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308694750.00007FF8B8B13000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8b00000_0jNz7djbpp.jbxd

Similarity

API ID: Err_Eval_Thread$AuditLongRestoreSaveSocketSys_$ErrorFormatFromHandleInformationLastLong_ModuleOccurredStringType_Windowsclosesocketgetsocknamegetsockoptmemset
String ID: Oiii$negative file descriptor$socket descriptor string has wrong size, should be %zu bytes.$socket.__new__
API String ID: 3363282672-2881308447
Opcode ID: 04267ebc9d147e07de267a693846aa419f582f40a8f4303f6ede1e2826baac7f
Instruction ID: bbf8c0ccfe7605b4934c5f759a0ac6037187c23125232a46d7744650ad8bbeaf
Opcode Fuzzy Hash: 04267ebc9d147e07de267a693846aa419f582f40a8f4303f6ede1e2826baac7f
Instruction Fuzzy Hash: 43B15F62A08A8682E6248F3D98046B96360FB99BE4F045335DF5D63AB1DF3CE586C704

Function 00007FF8A81B14BF Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 243
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8A820E73A
SetLastError.KERNEL32 ref: 00007FF8A820E741
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820E820
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A820E838
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820E861
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820E885
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820E8A7
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820E8C8
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820E8EA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A820E902
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820E939
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820EA00
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A820EA18
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820EA32
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A820EA4A
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A820EA5B
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FF8A820EA69

Strings

state_machine, xrefs: 00007FF8A820E82A, 00007FF8A820E8F4, 00007FF8A820EA05, 00007FF8A820EA37
..\s\ssl\statem\statem.c, xrefs: 00007FF8A820E831, 00007FF8A820E8FB, 00007FF8A820EA11, 00007FF8A820EA43

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_new$R_set_debug$ErrorLastM_freeR_clear_errorR_set_error
String ID: ..\s\ssl\statem\statem.c$state_machine
API String ID: 1370845099-1722249466
Opcode ID: 6f8aa62c0a17cd257a7cac7c3db44b12b48ed95985bfa37342f9ed60703b21dc
Instruction ID: b8ac0272301c21edf751f7037c03a1c67f9196e5b407c4d32d68a9cf09f5ea02
Opcode Fuzzy Hash: 6f8aa62c0a17cd257a7cac7c3db44b12b48ed95985bfa37342f9ed60703b21dc
Instruction Fuzzy Hash: 79A1A036A0E242A5F7A4BB65E4413B822A5EF85BC4F544431DA0D466AEDF3CECC1C379

Function 00007FF8B7804640 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyImport_ImportModuleLevelObject.PYTHON312 ref: 00007FF8B7804671
PyObject_GetAttr.PYTHON312 ref: 00007FF8B78046BD
PyUnicode_FromFormat.PYTHON312 ref: 00007FF8B78046DD
PyObject_GetItem.PYTHON312 ref: 00007FF8B78046F5
_Py_Dealloc.PYTHON312 ref: 00007FF8B780470C
PyDict_SetItem.PYTHON312 ref: 00007FF8B780472D
PyObject_SetItem.PYTHON312 ref: 00007FF8B7804735
_Py_Dealloc.PYTHON312 ref: 00007FF8B780474B
PyErr_Clear.PYTHON312 ref: 00007FF8B780477B
PyModule_GetFilenameObject.PYTHON312 ref: 00007FF8B7804784
PyUnicode_FromFormat.PYTHON312 ref: 00007FF8B78047A2
PyErr_SetImportError.PYTHON312 ref: 00007FF8B78047B9
_Py_Dealloc.PYTHON312 ref: 00007FF8B78047CD
_Py_Dealloc.PYTHON312 ref: 00007FF8B78047E1
_Py_Dealloc.PYTHON312 ref: 00007FF8B78047F5

Strings

cannot import name %R from %R (%S), xrefs: 00007FF8B7804792
%U.%U, xrefs: 00007FF8B78046D3

Memory Dump Source

Source File: 00000002.00000002.3307683054.00007FF8B7801000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8B7800000, based on PE: true

Associated: 00000002.00000002.3307626697.00007FF8B7800000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3307705255.00007FF8B7815000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3307746773.00007FF8B781B000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3307779004.00007FF8B781F000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7800000_0jNz7djbpp.jbxd

Similarity

API ID: Dealloc$ItemObject_$Err_FormatFromImportObjectUnicode_$AttrClearDict_ErrorFilenameImport_LevelModuleModule_
String ID: %U.%U$cannot import name %R from %R (%S)
API String ID: 3630264407-438398067
Opcode ID: fcd6dac6a765cb05053f4bfe7cd39cb166bae5586e68d4d28e2f2c7c25a5bf2f
Instruction ID: 0d50f2adb4bc13a150e15e27de9e34adb07a2c34cb8ea7f989bdf822a33ea25a
Opcode Fuzzy Hash: fcd6dac6a765cb05053f4bfe7cd39cb166bae5586e68d4d28e2f2c7c25a5bf2f
Instruction Fuzzy Hash: 4A513C76B18B8685EA148F1AA80867E6BA1FB4AFD5F448031CF4E47B74DF3CE0458308

Function 00007FF8A81B1C62 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A82154E4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82154FC
ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8A8215531
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FF8A8215546
X509_get0_pubkey.LIBCRYPTO-3 ref: 00007FF8A8215551
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8215587
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A821559F
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82155E4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82155FC

Strings

tls_post_process_server_certificate, xrefs: 00007FF8A82154E9, 00007FF8A821558C, 00007FF8A82155E9, 00007FF8A82156BB
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A82154F5, 00007FF8A8215598, 00007FF8A82155F5, 00007FF8A82156C7

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$L_sk_valueR_clear_errorX509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$tls_post_process_server_certificate
API String ID: 2779586248-3767186838
Opcode ID: db8201a799e0baeb7e7da45e6d94f051912b60767bec020adcc90b3d0adbc0ec
Instruction ID: f4e5fc205cd95cebd0a6c898c55fe64bb37cc0132ff7cfc89c078731d0a74e42
Opcode Fuzzy Hash: db8201a799e0baeb7e7da45e6d94f051912b60767bec020adcc90b3d0adbc0ec
Instruction Fuzzy Hash: AD518C72B1A682A2F750DB25D4453B823A1EB84BC4F644031ED4D4B79EDF3DE881C728

Function 00007FF8B8B06C48 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FF8B8B06C78
setsockopt.WS2_32 ref: 00007FF8B8B06CA2
PyErr_Clear.PYTHON312 ref: 00007FF8B8B06CAF
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FF8B8B06CF3
PyErr_Clear.PYTHON312 ref: 00007FF8B8B06D0A
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FF8B8B06D34
PyBuffer_Release.PYTHON312 ref: 00007FF8B8B06D50
PyErr_Format.PYTHON312 ref: 00007FF8B8B06D6D
setsockopt.WS2_32 ref: 00007FF8B8B06D93
PyBuffer_Release.PYTHON312 ref: 00007FF8B8B06DA0

Strings

iiO!I:setsockopt, xrefs: 00007FF8B8B06CCC
iiy*:setsockopt, xrefs: 00007FF8B8B06D2D
socket option is larger than %i bytes, xrefs: 00007FF8B8B06D5D
iii:setsockopt, xrefs: 00007FF8B8B06C71

Memory Dump Source

Source File: 00000002.00000002.3308593902.00007FF8B8B01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B8B00000, based on PE: true

Associated: 00000002.00000002.3308574801.00007FF8B8B00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308615266.00007FF8B8B09000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308675038.00007FF8B8B11000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308694750.00007FF8B8B13000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8b00000_0jNz7djbpp.jbxd

Similarity

API ID: Arg_Err_ParseSizeTuple_$Buffer_ClearReleasesetsockopt$Format
String ID: iiO!I:setsockopt$iii:setsockopt$iiy*:setsockopt$socket option is larger than %i bytes
API String ID: 418579395-1608436615
Opcode ID: 00bb59efab9f7172e8937e6f66c8eab6ad29b02b98a3246fc78355982980a26d
Instruction ID: a681239212a2ee41a856a8838896f1e1c35c43f49bdae9ac1f60e40e65858335
Opcode Fuzzy Hash: 00bb59efab9f7172e8937e6f66c8eab6ad29b02b98a3246fc78355982980a26d
Instruction Fuzzy Hash: 15410B3160CB8696EB208B39E4406A97360FB89BD4F500235DB9D53774DF3CD54ACB48

Function 00007FF8B8B029A0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PySys_Audit.PYTHON312 ref: 00007FF8B8B029BC
GetComputerNameExW.KERNEL32 ref: 00007FF8B8B029DD
PyUnicode_FromWideChar.PYTHON312 ref: 00007FF8B8B029F4
GetLastError.KERNEL32 ref: 00007FF8B8B03A1C
PyErr_SetFromWindowsErr.PYTHON312 ref: 00007FF8B8B03A2B

Strings

socket.gethostname, xrefs: 00007FF8B8B029B5

Memory Dump Source

Source File: 00000002.00000002.3308593902.00007FF8B8B01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B8B00000, based on PE: true

Associated: 00000002.00000002.3308574801.00007FF8B8B00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308615266.00007FF8B8B09000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308675038.00007FF8B8B11000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308694750.00007FF8B8B13000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8b00000_0jNz7djbpp.jbxd

Similarity

API ID: From$AuditCharComputerErr_ErrorLastNameSys_Unicode_WideWindows
String ID: socket.gethostname
API String ID: 1075394898-2650736202
Opcode ID: 3405576d76487752179143ca9e9ce24f0a64481455d61518cebafc033de9272a
Instruction ID: 2f4903d94902c58f2720ff244ed1ceb69d15f59156b5e2b862bd1c9b92347a40
Opcode Fuzzy Hash: 3405576d76487752179143ca9e9ce24f0a64481455d61518cebafc033de9272a
Instruction Fuzzy Hash: 41314F21A1CA4382E7659B79A81427E63A5FF8CBC4F444035DB4E626B4DF3CE10A8A08

Function 00007FF8A81B14F1 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF8A81F779F
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F783B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F7853
SetLastError.KERNEL32 ref: 00007FF8A81F78A2
BIO_read.LIBCRYPTO-3 ref: 00007FF8A81F78C9
BIO_test_flags.LIBCRYPTO-3 ref: 00007FF8A81F78EA
BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8A81F7900
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F7958
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F7970
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F79C0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F79D8

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8A81F784C, 00007FF8A81F7969, 00007FF8A81F79D1
ssl3_read_n, xrefs: 00007FF8A81F7840, 00007FF8A81F795D, 00007FF8A81F79C5

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$ErrorLastO_ctrlO_readO_test_flagsmemmove
String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_read_n
API String ID: 3874383451-4226281315
Opcode ID: b49a1a3092a1666878fcf2a6f1a6b22ad798a3b357faedcaa6a675de5e77afac
Instruction ID: 8452216df95d70d56227f4cf46b6ec0ee2e6a89d5c31f2d904562bded8346661
Opcode Fuzzy Hash: b49a1a3092a1666878fcf2a6f1a6b22ad798a3b357faedcaa6a675de5e77afac
Instruction Fuzzy Hash: 3991CF32A0A682A2FB52DF25D4047BD2294FF44BD8F544632DE4D47A89EFB9D845C328

Function 00007FF8A820E240 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

read_state_machine, xrefs: 00007FF8A820E4CD, 00007FF8A820E50A, 00007FF8A820E532, 00007FF8A820E5A5
..\s\ssl\statem\statem.c, xrefs: 00007FF8A820E4D4, 00007FF8A820E511, 00007FF8A820E53E, 00007FF8A820E5B1

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem.c$read_state_machine
API String ID: 0-3323778802
Opcode ID: 14377edc59a60446f09f780bfe0d0aa6ceb5de1d18d0f26ea132c90706a724b0
Instruction ID: 3e58ee868c38a02b00cca396a9ec9eca640e55bbb0cbea456a191ca7145f0271
Opcode Fuzzy Hash: 14377edc59a60446f09f780bfe0d0aa6ceb5de1d18d0f26ea132c90706a724b0
Instruction Fuzzy Hash: 6691A176B0A646A5FB10EF24E4443B92764FF84BC8F944136DA4D47699DF3CE885C328

Function 00007FF8B7DE1430 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyType_FromMetaclass.PYTHON312 ref: 00007FF8B7DE1450
PyType_FromMetaclass.PYTHON312 ref: 00007FF8B7DE1472
PyType_FromMetaclass.PYTHON312 ref: 00007FF8B7DE1493
PyType_FromMetaclass.PYTHON312 ref: 00007FF8B7DE14B5
PyModule_AddType.PYTHON312 ref: 00007FF8B7DE14CF
PyModule_AddType.PYTHON312 ref: 00007FF8B7DE14E0

Part of subcall function 00007FF8B7DE1560: PyImport_ImportModule.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1579
Part of subcall function 00007FF8B7DE1560: PyDict_New.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE158C
Part of subcall function 00007FF8B7DE1560: PySet_New.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE15A1
Part of subcall function 00007FF8B7DE1560: Py_BuildValue.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE15C2
Part of subcall function 00007FF8B7DE1560: PyImport_ImportModule.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE15DC
Part of subcall function 00007FF8B7DE1560: PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE15F8

PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B7DE1504
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B7DE151C
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B7DE1534

Strings

_eager_tasks, xrefs: 00007FF8B7DE1512
_scheduled_tasks, xrefs: 00007FF8B7DE14FA
_current_tasks, xrefs: 00007FF8B7DE152A

Memory Dump Source

Source File: 00000002.00000002.3308215869.00007FF8B7DE1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8B7DE0000, based on PE: true

Associated: 00000002.00000002.3308198035.00007FF8B7DE0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308274889.00007FF8B7DE8000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308295511.00007FF8B7DED000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308355103.00007FF8B7DEF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7de0000_0jNz7djbpp.jbxd

Similarity

API ID: Module_$FromMetaclassType_$Object$ImportImport_ModuleType$AttrBuildDict_Object_Set_StringValue
String ID: _current_tasks$_eager_tasks$_scheduled_tasks
API String ID: 1363086864-3186707196
Opcode ID: 12fd5d885d44a8ed9b8fe709351bc2f83f353a80f1f930472b50c377f5a435ad
Instruction ID: 321d7efb7ff85b98feb65a80b3cfe1868a9ce1c6b2b6c0cf0de95305b4de8a7d
Opcode Fuzzy Hash: 12fd5d885d44a8ed9b8fe709351bc2f83f353a80f1f930472b50c377f5a435ad
Instruction Fuzzy Hash: 68311C61B08B1382EF069B2DA5541BD2362AF05BD9B485236CF2F667B8DE3DE045C350

Function 00007FF8B7808EC3 Relevance: 19.6, APIs: 13, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B78041E0: PyUnicode_FromStringAndSize.PYTHON312 ref: 00007FF8B78042E9
Part of subcall function 00007FF8B78041E0: PyUnicode_InternInPlace.PYTHON312 ref: 00007FF8B7804302

_Py_Dealloc.PYTHON312 ref: 00007FF8B7808F2B
_Py_Dealloc.PYTHON312 ref: 00007FF8B7808F63
_Py_Dealloc.PYTHON312 ref: 00007FF8B7808F7B
_Py_Dealloc.PYTHON312 ref: 00007FF8B7808F9E
_Py_Dealloc.PYTHON312 ref: 00007FF8B7808FC1
_Py_Dealloc.PYTHON312 ref: 00007FF8B7808FE4
_Py_Dealloc.PYTHON312 ref: 00007FF8B7809007
_Py_Dealloc.PYTHON312 ref: 00007FF8B780902A
_Py_Dealloc.PYTHON312 ref: 00007FF8B780904D
_Py_Dealloc.PYTHON312 ref: 00007FF8B7809070
_Py_Dealloc.PYTHON312 ref: 00007FF8B7809093
_Py_Dealloc.PYTHON312 ref: 00007FF8B78090B6
_Py_Dealloc.PYTHON312 ref: 00007FF8B78090D9

Memory Dump Source

Source File: 00000002.00000002.3307683054.00007FF8B7801000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8B7800000, based on PE: true

Associated: 00000002.00000002.3307626697.00007FF8B7800000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3307705255.00007FF8B7815000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3307746773.00007FF8B781B000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3307779004.00007FF8B781F000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7800000_0jNz7djbpp.jbxd

Similarity

API ID: Dealloc$Unicode_$FromInternPlaceSizeString
String ID:
API String ID: 2745024575-0
Opcode ID: 091893d1f0e79c71c802a693a5176002506af28f025ec817263c4d69333cf0a2
Instruction ID: 3daab18009392419b418428a7af521fd17e246dceac7691719cefb292f2fe9fd
Opcode Fuzzy Hash: 091893d1f0e79c71c802a693a5176002506af28f025ec817263c4d69333cf0a2
Instruction Fuzzy Hash: D271D336F2AB0289FA558B2DA94413E7BE5FF58BD1F184434C70D82A70DE3EA4818748

Function 00007FF8A820EC70 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,-00000031,00007FF8A820E9C6), ref: 00007FF8A820ED22
ERR_set_debug.LIBCRYPTO-3(?,?,?,-00000031,00007FF8A820E9C6), ref: 00007FF8A820ED3A

Strings

write_state_machine, xrefs: 00007FF8A820ED2C, 00007FF8A820F01B
..\s\ssl\statem\statem.c, xrefs: 00007FF8A820ED33, 00007FF8A820F022

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem.c$write_state_machine
API String ID: 193678381-552286378
Opcode ID: 1edee16b17f7b7a209ddbeed6cd636bdd8764bdbe6572802cc707b3b873bb90e
Instruction ID: 503b4a79a05bdb56ea6d5d8d73e38c61368283704d0c96f33b6736a755afda7d
Opcode Fuzzy Hash: 1edee16b17f7b7a209ddbeed6cd636bdd8764bdbe6572802cc707b3b873bb90e
Instruction Fuzzy Hash: E4A1C036A0A546A6FB21EF25E4583B923B5FB807C8F540036DA4D436D9DF3CE985C724

Function 00007FF8B78A1C90 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B78A1CF2
PyUnicode_AsUTF8AndSize.PYTHON312 ref: 00007FF8B78A1D2E
PyObject_IsTrue.PYTHON312 ref: 00007FF8B78A1D63

Strings

embedded null character, xrefs: 00007FF8B78A3737
argument 'txt', xrefs: 00007FF8B78A370F
str, xrefs: 00007FF8B78A3716
txt2obj, xrefs: 00007FF8B78A371D

Memory Dump Source

Source File: 00000002.00000002.3307994633.00007FF8B78A1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B78A0000, based on PE: true

Associated: 00000002.00000002.3307937546.00007FF8B78A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308015574.00007FF8B78AD000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308042923.00007FF8B78C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308061879.00007FF8B78C1000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308135419.00007FF8B78C7000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308176623.00007FF8B78C9000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b78a0000_0jNz7djbpp.jbxd

Similarity

API ID: Arg_KeywordsObject_SizeTrueUnicode_Unpack
String ID: argument 'txt'$embedded null character$str$txt2obj
API String ID: 3371007025-2001486153
Opcode ID: ba8e0275eb7ae53edb31ef97c2f8e1e5acff8c5ed8bf0fbbc7c7392eccbb918b
Instruction ID: 022519d5580198dc9daba6ac5ca5022c6388733226ee2d1048f3278ba62734ff
Opcode Fuzzy Hash: ba8e0275eb7ae53edb31ef97c2f8e1e5acff8c5ed8bf0fbbc7c7392eccbb918b
Instruction Fuzzy Hash: 0F31AE22B0CB4695EA618B19E8042BD2B60FB85BD0F484131CF5E87BB4DF3CE445C308

Function 00007FF8B7DE16B9 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 33COMMON

Download Yara Rule

APIs

PyImport_ImportModule.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE16C8
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE16E4
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1704
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1721
PyImport_ImportModule.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE174A
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1766
_Py_Dealloc.PYTHON312 ref: 00007FF8B7DE291F
_Py_Dealloc.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE29CE

Strings

_task_get_stack, xrefs: 00007FF8B7DE16FA
_task_repr, xrefs: 00007FF8B7DE16DA
_task_print_stack, xrefs: 00007FF8B7DE1717
asyncio.base_tasks, xrefs: 00007FF8B7DE16C1

Memory Dump Source

Source File: 00000002.00000002.3308215869.00007FF8B7DE1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8B7DE0000, based on PE: true

Associated: 00000002.00000002.3308198035.00007FF8B7DE0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308274889.00007FF8B7DE8000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308295511.00007FF8B7DED000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308355103.00007FF8B7DEF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7de0000_0jNz7djbpp.jbxd

Similarity

API ID: AttrObject_String$DeallocImportImport_Module
String ID: _task_get_stack$_task_print_stack$_task_repr$asyncio.base_tasks
API String ID: 299536401-892118
Opcode ID: 53115703cdc97a1b282f4c9d93a9daa018099d852e6ec4844eef5b923becfe5a
Instruction ID: eaffe4ed80233ed95a74b0f787147dfb9de281b3164f9bd80da58d329aea56af
Opcode Fuzzy Hash: 53115703cdc97a1b282f4c9d93a9daa018099d852e6ec4844eef5b923becfe5a
Instruction Fuzzy Hash: DA017225B49F0395FE179B1DA85427C22A4AF09BD1F4C2235CB6E623B8EF7CF5558220

Function 00007FF8B8B0442C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 84networkthreadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FF8B8B0444A
connect.WS2_32 ref: 00007FF8B8B0445D
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8B04468
WSAGetLastError.WS2_32 ref: 00007FF8B8B04476
WSAGetLastError.WS2_32 ref: 00007FF8B8B04482
PyErr_CheckSignals.PYTHON312 ref: 00007FF8B8B0448F
WSASetLastError.WS2_32 ref: 00007FF8B8B044CC

Strings

3', xrefs: 00007FF8B8B044B0

Memory Dump Source

Source File: 00000002.00000002.3308593902.00007FF8B8B01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B8B00000, based on PE: true

Associated: 00000002.00000002.3308574801.00007FF8B8B00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308615266.00007FF8B8B09000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308675038.00007FF8B8B11000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308694750.00007FF8B8B13000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8b00000_0jNz7djbpp.jbxd

Similarity

API ID: ErrorLast$Eval_Thread$CheckErr_RestoreSaveSignalsconnect
String ID: 3'
API String ID: 4284410693-280543908
Opcode ID: bf1f35104443e8bdc2e2b3dc93d8a66b39ca7049add94a43049c608f9c8392d5
Instruction ID: 1ae0d2da0de526ee6e17705f0dcb884553f32d9de6a00f9c71ed1afdf05c1f2d
Opcode Fuzzy Hash: bf1f35104443e8bdc2e2b3dc93d8a66b39ca7049add94a43049c608f9c8392d5
Instruction Fuzzy Hash: 0D316031B0874386EB688F3AA84457E6690BF487D9F040135EF5EA6BB5DF3CE4468608

Function 00007FF8B7DE1657 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

PyImport_ImportModule.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1666
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1682
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE169F
PyImport_ImportModule.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE16C8
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE16E4
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1704
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1721
_Py_Dealloc.PYTHON312 ref: 00007FF8B7DE2902
_Py_Dealloc.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE29CE

Strings

asyncio.exceptions, xrefs: 00007FF8B7DE165F
InvalidStateError, xrefs: 00007FF8B7DE1678
CancelledError, xrefs: 00007FF8B7DE1695

Memory Dump Source

Source File: 00000002.00000002.3308215869.00007FF8B7DE1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8B7DE0000, based on PE: true

Associated: 00000002.00000002.3308198035.00007FF8B7DE0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308274889.00007FF8B7DE8000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308295511.00007FF8B7DED000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308355103.00007FF8B7DEF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7de0000_0jNz7djbpp.jbxd

Similarity

API ID: AttrObject_String$DeallocImportImport_Module
String ID: CancelledError$InvalidStateError$asyncio.exceptions
API String ID: 299536401-2834584619
Opcode ID: 8653cd9b8435265424d397c63cc7322f5db4f2de80bfe725d30894f5968c0b65
Instruction ID: 16b181d09207c27b147b3490a2f7fba36c4eb4309652a6a385c04cb33c1cc1a6
Opcode Fuzzy Hash: 8653cd9b8435265424d397c63cc7322f5db4f2de80bfe725d30894f5968c0b65
Instruction Fuzzy Hash: 26F07424A49B0395FE178B1DA85417C22A0AF497C5F4C2635CB2E622BCEF3DF555D211

Function 00007FF8B8CB1132 Relevance: 12.1, APIs: 8, Instructions: 101networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8B8CB11C1
WSAIoctl.WS2_32 ref: 00007FF8B8CB120D
WSAIoctl.WS2_32 ref: 00007FF8B8CB1253
WSAIoctl.WS2_32 ref: 00007FF8B8CB1299
WSAIoctl.WS2_32 ref: 00007FF8B8CB12DF
closesocket.WS2_32 ref: 00007FF8B8CB12F1
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FF8B8CB1304
PyModule_AddType.PYTHON312 ref: 00007FF8B8CB25F8

Memory Dump Source

Source File: 00000002.00000002.3309145812.00007FF8B8CB1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B8CB0000, based on PE: true

Associated: 00000002.00000002.3309123846.00007FF8B8CB0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.3309185509.00007FF8B8CB6000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.3309205030.00007FF8B8CBA000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.3309222046.00007FF8B8CBB000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8cb0000_0jNz7djbpp.jbxd

Similarity

API ID: Ioctl$FromModuleModule_SpecTypeType_closesocketsocket
String ID:
API String ID: 3646089292-0
Opcode ID: 4e14f9fe0293fbf09bee7e81692312db8d643e17916b8b9c1467ccfad0bfef0e
Instruction ID: 2fc022eca9adfcd968c0a2e3bd1bd9f38dd83295b22edc32d22f1293abca04fb
Opcode Fuzzy Hash: 4e14f9fe0293fbf09bee7e81692312db8d643e17916b8b9c1467ccfad0bfef0e
Instruction Fuzzy Hash: 3A51ABB2108F468EE3A08F28E45829A3765FB45398F500225EB9D07F98DF3DD65ACB04

Function 00007FF8A8220710 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8220836
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A822084E
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82208CE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82208E6

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8A8220847, 00007FF8A82208DF
tls_get_message_header, xrefs: 00007FF8A822083B, 00007FF8A82208D3

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_get_message_header
API String ID: 193678381-2714770296
Opcode ID: 0a675c68133e8178ac648a78a03b7d1437f40432096ecb796daf1537fba5ad51
Instruction ID: 885b4074a59091915e7821000c123ffdfaa359e047c3460b5290bf8dc10b059f
Opcode Fuzzy Hash: 0a675c68133e8178ac648a78a03b7d1437f40432096ecb796daf1537fba5ad51
Instruction Fuzzy Hash: 2D616F32A09781A6EB60CF25E4543B937A4FB84B88F088036DB9D47799EF3CD455C728

Function 00007FF8B8B05950 Relevance: 10.6, APIs: 7, Instructions: 103COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B8B059E0
_PyLong_AsInt.PYTHON312 ref: 00007FF8B8B059FF
PyErr_Occurred.PYTHON312 ref: 00007FF8B8B05A0C
_PyLong_AsInt.PYTHON312 ref: 00007FF8B8B05A26
PyErr_Occurred.PYTHON312 ref: 00007FF8B8B05A33
_PyLong_AsInt.PYTHON312 ref: 00007FF8B8B05A4D
PyErr_Occurred.PYTHON312 ref: 00007FF8B8B05A5B

Memory Dump Source

Source File: 00000002.00000002.3308593902.00007FF8B8B01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B8B00000, based on PE: true

Associated: 00000002.00000002.3308574801.00007FF8B8B00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308615266.00007FF8B8B09000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308675038.00007FF8B8B11000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308694750.00007FF8B8B13000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8b00000_0jNz7djbpp.jbxd

Similarity

API ID: Err_Long_Occurred$Arg_KeywordsUnpack
String ID:
API String ID: 591546834-0
Opcode ID: 76780f2171b9a0c666538e7470a80e626d3e221b20e6fde9062a3a99cfec385c
Instruction ID: 5f0748e35423f51f4676c4c0fb2f3f6153c770f509e1843da1df662605526ab5
Opcode Fuzzy Hash: 76780f2171b9a0c666538e7470a80e626d3e221b20e6fde9062a3a99cfec385c
Instruction Fuzzy Hash: E541CF62E1D64246FE609B79A844B792290BF08BE0F044631DF1D37BF0DF3CE4468658

Function 00007FF8A81CFAE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CFB00
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CFB18
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CFB28
ASYNC_get_current_job.LIBCRYPTO-3 ref: 00007FF8A81CFB75

Strings

SSL_do_handshake, xrefs: 00007FF8A81CFB05
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CFB11

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: C_get_current_jobR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_do_handshake
API String ID: 2134390360-2964568172
Opcode ID: c91630741219631a69d9c5f3432363629406958cc77146902cc34db31b5e4eda
Instruction ID: 2c7260f5c0be5bbae8c81fcbb5f28c97cc12416b6c89db786301eb0f86ac20f1
Opcode Fuzzy Hash: c91630741219631a69d9c5f3432363629406958cc77146902cc34db31b5e4eda
Instruction Fuzzy Hash: 1621B022B09746A2E751EB36E4413BD2351EF887C8F580231EA4D0278AEF2CE190C668

Function 00007FF8B8B04668 Relevance: 9.0, APIs: 6, Instructions: 34threadnetworkCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312(?,?,?,00007FF8B8B04412), ref: 00007FF8B8B0467C
ioctlsocket.WS2_32 ref: 00007FF8B8B046A1
PyEval_RestoreThread.PYTHON312(?,?,?,00007FF8B8B04412), ref: 00007FF8B8B046AE
PyEval_RestoreThread.PYTHON312(?,?,?,00007FF8B8B04412), ref: 00007FF8B8B046B8
WSAGetLastError.WS2_32(?,?,?,00007FF8B8B04412), ref: 00007FF8B8B046BE
PyErr_SetExcFromWindowsErr.PYTHON312(?,?,?,00007FF8B8B04412), ref: 00007FF8B8B046D0

Memory Dump Source

Source File: 00000002.00000002.3308593902.00007FF8B8B01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B8B00000, based on PE: true

Associated: 00000002.00000002.3308574801.00007FF8B8B00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308615266.00007FF8B8B09000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308675038.00007FF8B8B11000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308694750.00007FF8B8B13000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8b00000_0jNz7djbpp.jbxd

Similarity

API ID: Eval_Thread$Restore$Err_ErrorFromLastSaveWindowsioctlsocket
String ID:
API String ID: 863680558-0
Opcode ID: 402f04bb7d9212ea08196dd74a4af80d90a7af6c1d596dfc1541eee4981e6f64
Instruction ID: 9881f6e72b79a73dbcce11627180ecfaa798eedd35efe4f96bca6ef0b4c718a0
Opcode Fuzzy Hash: 402f04bb7d9212ea08196dd74a4af80d90a7af6c1d596dfc1541eee4981e6f64
Instruction Fuzzy Hash: C1014F31B19B4282E3149B7AE84406A73A0FF88BD4F504030EB5E67B74DF3CE4968704

Function 00007FF8B78A1DA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

OBJ_txt2obj.LIBCRYPTO-3 ref: 00007FF8B78A1DC0
PyModule_GetState.PYTHON312 ref: 00007FF8B78A1DD5

Part of subcall function 00007FF8B78A1E08: OBJ_obj2nid.LIBCRYPTO-3(?,?,?,?,?,00007FF8B78A1DE6), ref: 00007FF8B78A1E2A
Part of subcall function 00007FF8B78A1E08: OBJ_nid2sn.LIBCRYPTO-3(?,?,?,?,?,00007FF8B78A1DE6), ref: 00007FF8B78A1E3C
Part of subcall function 00007FF8B78A1E08: OBJ_nid2ln.LIBCRYPTO-3(?,?,?,?,?,00007FF8B78A1DE6), ref: 00007FF8B78A1E47
Part of subcall function 00007FF8B78A1E08: _Py_BuildValue_SizeT.PYTHON312(?,?,?,?,?,00007FF8B78A1DE6), ref: 00007FF8B78A1E75

ASN1_OBJECT_free.LIBCRYPTO-3 ref: 00007FF8B78A1DEC
PyErr_Format.PYTHON312 ref: 00007FF8B78A3762

Strings

unknown object '%.100s', xrefs: 00007FF8B78A3755

Memory Dump Source

Source File: 00000002.00000002.3307994633.00007FF8B78A1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B78A0000, based on PE: true

Associated: 00000002.00000002.3307937546.00007FF8B78A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308015574.00007FF8B78AD000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308042923.00007FF8B78C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308061879.00007FF8B78C1000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308135419.00007FF8B78C7000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308176623.00007FF8B78C9000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b78a0000_0jNz7djbpp.jbxd

Similarity

API ID: BuildErr_FormatJ_nid2lnJ_nid2snJ_obj2nidJ_txt2objModule_SizeStateT_freeValue_
String ID: unknown object '%.100s'
API String ID: 2376969911-3113687063
Opcode ID: 82eac1858f2f7311b97fa416a6cda790fa35309ca6d5bca797571051d7cfa703
Instruction ID: f007dd23a2947bdd4f599563f1b4b44a0c710cad3d2f2a0f2c4f3a80f42dcd4b
Opcode Fuzzy Hash: 82eac1858f2f7311b97fa416a6cda790fa35309ca6d5bca797571051d7cfa703
Instruction Fuzzy Hash: 9FF03165B1CB4682EE04CB6BA95407D5A62AF8CFD0B484430DF1E87B38DE7CE4458714

Function 00007FF8B7DE1612 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyImport_ImportModule.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1621
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE163D
PyImport_ImportModule.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1666
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE1682
PyObject_GetAttrString.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE169F
_Py_Dealloc.PYTHON312 ref: 00007FF8B7DE28E5
_Py_Dealloc.PYTHON312(?,?,?,00007FF8B7DE14F2), ref: 00007FF8B7DE29CE

Strings

asyncio.base_futures, xrefs: 00007FF8B7DE161A
_future_repr, xrefs: 00007FF8B7DE1633

Memory Dump Source

Source File: 00000002.00000002.3308215869.00007FF8B7DE1000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8B7DE0000, based on PE: true

Associated: 00000002.00000002.3308198035.00007FF8B7DE0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308274889.00007FF8B7DE8000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308295511.00007FF8B7DED000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.3308355103.00007FF8B7DEF000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7de0000_0jNz7djbpp.jbxd

Similarity

API ID: AttrObject_String$DeallocImportImport_Module
String ID: _future_repr$asyncio.base_futures
API String ID: 299536401-3081697843
Opcode ID: 1f080ac08595b9df825541c240a6507a57e47eaef4de5bd3019a5f132da7cc69
Instruction ID: 49ff4954311f277c7a876da44d5197ccfc64e3bcc159cd7c1caab20d1fc5ee3b
Opcode Fuzzy Hash: 1f080ac08595b9df825541c240a6507a57e47eaef4de5bd3019a5f132da7cc69
Instruction Fuzzy Hash: 67F0A520B0DB0395FE178B1D985417C23A0AF08BC5F5C2639CB2E622BCEF3DB5459221

Function 00007FF8B8C11000 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyImport_ImportModule.PYTHON312 ref: 00007FF8B8C1100B
_Py_Dealloc.PYTHON312 ref: 00007FF8B8C11024
PyCapsule_Import.PYTHON312 ref: 00007FF8B8C11033

Strings

charset_normalizer.md__mypyc.init_charset_normalizer___md, xrefs: 00007FF8B8C1102C
charset_normalizer.md__mypyc, xrefs: 00007FF8B8C11004

Memory Dump Source

Source File: 00000002.00000002.3308979658.00007FF8B8C11000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B8C10000, based on PE: true

Associated: 00000002.00000002.3308962770.00007FF8B8C10000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3309034589.00007FF8B8C12000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3309054685.00007FF8B8C14000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8c10000_0jNz7djbpp.jbxd

Similarity

API ID: Import$Capsule_DeallocImport_Module
String ID: charset_normalizer.md__mypyc$charset_normalizer.md__mypyc.init_charset_normalizer___md
API String ID: 1394619730-824592145
Opcode ID: 5974c19f225ccfaa67e8cfdf14026b0452581abd6b019d6115b8283005d03241
Instruction ID: 8825e7c9e556777cdfb5299b33f71b00a0d9c3f9d79e872d90bec8cf8946733a
Opcode Fuzzy Hash: 5974c19f225ccfaa67e8cfdf14026b0452581abd6b019d6115b8283005d03241
Instruction Fuzzy Hash: ABE0C0A5E09543C1EBD5EF19ACEC27622917F54F80F456435C30D41690EF2DA9878718

Function 00007FF8B8B05358 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B8B03D80: PyErr_Format.PYTHON312 ref: 00007FF8B8B04102

PySys_Audit.PYTHON312 ref: 00007FF8B8B053B0

Part of subcall function 00007FF8B8B0442C: PyEval_SaveThread.PYTHON312 ref: 00007FF8B8B0444A
Part of subcall function 00007FF8B8B0442C: connect.WS2_32 ref: 00007FF8B8B0445D
Part of subcall function 00007FF8B8B0442C: PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8B04468
Part of subcall function 00007FF8B8B0442C: WSAGetLastError.WS2_32 ref: 00007FF8B8B04476
Part of subcall function 00007FF8B8B0442C: WSAGetLastError.WS2_32 ref: 00007FF8B8B04482
Part of subcall function 00007FF8B8B0442C: PyErr_CheckSignals.PYTHON312 ref: 00007FF8B8B0448F
Part of subcall function 00007FF8B8B0442C: WSASetLastError.WS2_32 ref: 00007FF8B8B044CC

Strings

connect, xrefs: 00007FF8B8B05377
socket.connect, xrefs: 00007FF8B8B053A9

Memory Dump Source

Source File: 00000002.00000002.3308593902.00007FF8B8B01000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B8B00000, based on PE: true

Associated: 00000002.00000002.3308574801.00007FF8B8B00000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308615266.00007FF8B8B09000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308675038.00007FF8B8B11000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000002.00000002.3308694750.00007FF8B8B13000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8b00000_0jNz7djbpp.jbxd

Similarity

API ID: ErrorLast$Err_Eval_Thread$AuditCheckFormatRestoreSaveSignalsSys_connect
String ID: connect$socket.connect
API String ID: 2206401578-326844852
Opcode ID: 6328d35a7a5ebb17eb66f0d37f02297ffde66ec9a7956e232188b9311fc926bd
Instruction ID: 9eb496fbe6c5690d876d4bf862b10793974c148ad19737c7555956029580df19
Opcode Fuzzy Hash: 6328d35a7a5ebb17eb66f0d37f02297ffde66ec9a7956e232188b9311fc926bd
Instruction Fuzzy Hash: 24115B21B1CA8681E7209B3AF4507AA7360FF487C4F440132DB4E67A65DF7CE546CB08

Function 00007FF8A820E5EC Relevance: 4.8, APIs: 3, Instructions: 344COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8A820E73A
SetLastError.KERNEL32 ref: 00007FF8A820E741
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FF8A820EA69

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: ce68793f5ed94765da0cf06069d6cda8a1f14ed55aa43607596081dc107df58f
Instruction ID: e60078dc29fa8c0913a5d540cb8229fac8527984c71b5bcaa9551d55a5003dee
Opcode Fuzzy Hash: ce68793f5ed94765da0cf06069d6cda8a1f14ed55aa43607596081dc107df58f
Instruction Fuzzy Hash: 0031E37BA0A202AAF764AE51A48127D27B0FF50BC4F584431DE494369ADF3CECC1C764

Function 00007FF8A81B1DF2 Relevance: 4.6, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8A820E73A
SetLastError.KERNEL32 ref: 00007FF8A820E741
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FF8A820EA69

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: 30f5a756a2453722bd5fc7c60f00636787785f570310c9cdf96fb774af82a049
Instruction ID: 6ee58a3862a1c8de3785ac7f7f00a546963c66fb8400c61289ceddb842734cba
Opcode Fuzzy Hash: 30f5a756a2453722bd5fc7c60f00636787785f570310c9cdf96fb774af82a049
Instruction Fuzzy Hash: 9831923AA0A242A9F764BE65A44027D23B5FF44BC4F584431DE494769ADF3CECC1C7A8

Function 00007FF8B781252E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8B781253D

Strings

<module>, xrefs: 00007FF8B7813822

Memory Dump Source

Source File: 00000002.00000002.3307683054.00007FF8B7801000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8B7800000, based on PE: true

Associated: 00000002.00000002.3307626697.00007FF8B7800000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3307705255.00007FF8B7815000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3307746773.00007FF8B781B000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3307779004.00007FF8B781F000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7800000_0jNz7djbpp.jbxd

Similarity

API ID: Dealloc
String ID: <module>
API String ID: 3617616757-217463007
Opcode ID: 3d0b5fe31bdceefd0d16471987016516823057e139ed2a49c540c935358a7bd8
Instruction ID: 4a6c3fd140e0b2b106de4c01b12f65c5349e3e504e9ec7bf0be96d0ebe000ae8
Opcode Fuzzy Hash: 3d0b5fe31bdceefd0d16471987016516823057e139ed2a49c540c935358a7bd8
Instruction Fuzzy Hash: FDF05E6AF29B4385FA159B0DA8600BE2B51AF887D1B804035CF0D57EB1EF2CB6418708

Function 00007FF8A820E330 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBCRYPTO-3(?,?,?,?,-00000031,?,00007FF8A820E9A4), ref: 00007FF8A820E3D7

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: M_grow_clean
String ID:
API String ID: 964628749-0
Opcode ID: ff409e93fcb0d36c1aaad829d7e6a47c84e60de949b34c47c74b208e88b9b461
Instruction ID: 66cbb3add159c4981a37eab867dfcf1504cb7f2dfbd37124c7333202c15b9810
Opcode Fuzzy Hash: ff409e93fcb0d36c1aaad829d7e6a47c84e60de949b34c47c74b208e88b9b461
Instruction Fuzzy Hash: 39418176A0A68695FB24AF25E15037D2BA1EB44BC8F088535CE8D4779CDF3CE881C724

Function 00007FF8B78A81D8 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8B78A825D

Memory Dump Source

Source File: 00000002.00000002.3307994633.00007FF8B78A1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8B78A0000, based on PE: true

Associated: 00000002.00000002.3307937546.00007FF8B78A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308015574.00007FF8B78AD000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308042923.00007FF8B78C0000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308061879.00007FF8B78C1000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308135419.00007FF8B78C7000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.3308176623.00007FF8B78C9000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b78a0000_0jNz7djbpp.jbxd

Similarity

API ID: Arg_KeywordsUnpack
String ID:
API String ID: 1409375599-0
Opcode ID: 2dde85019f923016d4c3f5a17233583584655f92e70c11fe7567d4c50d67d2ea
Instruction ID: 24a2719ac9674758078dd2cf8a0da8498fa5e031ca027a1177f79c7b6ad370a2
Opcode Fuzzy Hash: 2dde85019f923016d4c3f5a17233583584655f92e70c11fe7567d4c50d67d2ea
Instruction Fuzzy Hash: 5221BF62B09B5281EA528F8AA80097DABA4BF49BD4F450031EF4D277A4EE3CE401C714

Function 00007FF8A81B1F46 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8A81C0598

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: f7c6bf918bb27fd1467e601db5dcc4726319ecb0557afeb55f8d086d6d4849ab
Instruction ID: ee96e0a5d733459ab601edc918a9a6053af67f58c8d0f87c830f1d9296bccc67
Opcode Fuzzy Hash: f7c6bf918bb27fd1467e601db5dcc4726319ecb0557afeb55f8d086d6d4849ab
Instruction Fuzzy Hash: 50319A72A0AB8486E750CF61E400BDA77A0FB85B88F484136EF8D4BB59CF38D544CB18

Function 00007FF8A81B1D43 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8A820EC36

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: bfe36b7522bdb383b583256963e0cb7d483da4068be122a2aa8aa4264da1dd87
Instruction ID: 460e650923af1860c1b259a1105b376bebf2d3927336240133d1e5fd08af6a37
Opcode Fuzzy Hash: bfe36b7522bdb383b583256963e0cb7d483da4068be122a2aa8aa4264da1dd87
Instruction Fuzzy Hash: 73E048F6F0610256F71057659446BB812A0EB99754F541030DE0C86686E76ED9D2C618

Non-executed Functions

Function 00007FF8A81B1C12 Relevance: 95.0, APIs: 36, Strings: 18, Instructions: 483COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_reset.LIBCRYPTO-3 ref: 00007FF8A81EF0AC
EVP_CIPHER_CTX_new.LIBCRYPTO-3 ref: 00007FF8A81EF0D2
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81EF0E3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81EF0FB
EVP_CIPHER_CTX_reset.LIBCRYPTO-3 ref: 00007FF8A81EF131
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8A81EF1B7
EVP_CIPHER_CTX_new.LIBCRYPTO-3 ref: 00007FF8A81EF1CE
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81EF1E3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81EF1FB
BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8A81EF28F
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81EF29B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81EF2B3
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81EF315
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81EF32D
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8A81EF571
memcpy.VCRUNTIME140 ref: 00007FF8A81EF631
memcpy.VCRUNTIME140 ref: 00007FF8A81EF650
memcpy.VCRUNTIME140 ref: 00007FF8A81EF74A
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FF8A81EF889
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FF8A81EF897

Strings

c hs traffic, xrefs: 00007FF8A81EF584
s ap traffic, xrefs: 00007FF8A81EF160, 00007FF8A81EF617, 00007FF8A81EF72A
c ap traffic, xrefs: 00007FF8A81EF16A, 00007FF8A81EF655, 00007FF8A81EF6BB
EXPORTER_SECRET, xrefs: 00007FF8A81EF7AF
res master, xrefs: 00007FF8A81EF678
SERVER_TRAFFIC_SECRET_0, xrefs: 00007FF8A81EF224
exp master, xrefs: 00007FF8A81EF766
CLIENT_EARLY_TRAFFIC_SECRET, xrefs: 00007FF8A81EF27F
s hs traffic, xrefs: 00007FF8A81EF174, 00007FF8A81EF636
CLIENT_HANDSHAKE_TRAFFIC_SECRET, xrefs: 00007FF8A81EF576
e exp master, xrefs: 00007FF8A81EF47B
tls13_change_cipher_state, xrefs: 00007FF8A81EF0E8, 00007FF8A81EF1E8, 00007FF8A81EF2A0, 00007FF8A81EF31A, 00007FF8A81EF351, 00007FF8A81EF395, 00007FF8A81EF4BA, 00007FF8A81EF515
..\s\ssl\tls13_enc.c, xrefs: 00007FF8A81EF0F4, 00007FF8A81EF1F4, 00007FF8A81EF2AC, 00007FF8A81EF326, 00007FF8A81EF35D, 00007FF8A81EF3A1, 00007FF8A81EF4C6, 00007FF8A81EF521
finished, xrefs: 00007FF8A81EF814
CLIENT_TRAFFIC_SECRET_0, xrefs: 00007FF8A81EF59D
EARLY_EXPORTER_SECRET, xrefs: 00007FF8A81EF4F1
c e traffic, xrefs: 00007FF8A81EF155, 00007FF8A81EF858
SERVER_HANDSHAKE_TRAFFIC_SECRET, xrefs: 00007FF8A81EF1C5

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$memcpy$D_get_sizeL_cleanseX_newX_reset$O_ctrl
String ID: ..\s\ssl\tls13_enc.c$CLIENT_EARLY_TRAFFIC_SECRET$CLIENT_HANDSHAKE_TRAFFIC_SECRET$CLIENT_TRAFFIC_SECRET_0$EARLY_EXPORTER_SECRET$EXPORTER_SECRET$SERVER_HANDSHAKE_TRAFFIC_SECRET$SERVER_TRAFFIC_SECRET_0$c ap traffic$c e traffic$c hs traffic$e exp master$exp master$finished$res master$s ap traffic$s hs traffic$tls13_change_cipher_state
API String ID: 3475700188-318917415
Opcode ID: b29c2bc6028ee1f1bb12059b3d6d67ed1f873342f9f61c88aa7ef0c1339314fb
Instruction ID: 51f42e1e164f2d922003b59066e4314c172227f8ef79c0391cd70cb7f9599a11
Opcode Fuzzy Hash: b29c2bc6028ee1f1bb12059b3d6d67ed1f873342f9f61c88aa7ef0c1339314fb
Instruction Fuzzy Hash: 95329B22A0AB42A6FB15DB61E8407F963A4FB847C4F400136EE4D43B99EF3CE555C768

Function 00007FF8A81B1B54 Relevance: 84.6, APIs: 45, Strings: 3, Instructions: 596COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF8A8218312
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8218324
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A821833C
ERR_new.LIBCRYPTO-3 ref: 00007FF8A821854B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8218563
memcmp.VCRUNTIME140 ref: 00007FF8A8218592
EVP_CIPHER_CTX_free.LIBCRYPTO-3 ref: 00007FF8A82185C9
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8218634
ERR_new.LIBCRYPTO-3 ref: 00007FF8A821864F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8218667
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A82186CE
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82186DE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82186F6
ERR_new.LIBCRYPTO-3 ref: 00007FF8A821873E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8218756
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8218C54
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8218C60
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8218C78
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8218CA4

Strings

tls_process_server_hello, xrefs: 00007FF8A8218329, 00007FF8A8218550, 00007FF8A82186E3, 00007FF8A8218743, 00007FF8A82187B5, 00007FF8A8218851, 00007FF8A8218924, 00007FF8A8218A2A, 00007FF8A8218A91, 00007FF8A8218B6E, 00007FF8A8218BB9, 00007FF8A8218BE6, 00007FF8A8218C23, 00007FF8A8218C6A
tls_process_as_hello_retry_request, xrefs: 00007FF8A8218654
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A8218335, 00007FF8A821855C, 00007FF8A8218627, 00007FF8A8218660, 00007FF8A82186C1, 00007FF8A82186EF, 00007FF8A821874F, 00007FF8A82187C1, 00007FF8A821885D, 00007FF8A8218930, 00007FF8A8218A36, 00007FF8A8218A9D, 00007FF8A8218B41, 00007FF8A8218B7A, 00007FF8A8218BC5, 00007FF8A8218BF2, 00007FF8A8218C2F, 00007FF8A8218C71, 00007FF8A8218C97

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_new$R_set_debug$O_free$memcmp$X_free
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_as_hello_retry_request$tls_process_server_hello
API String ID: 1017169752-619482627
Opcode ID: 102599edab9d1245af7d949caaf4fea315e2b9aba34f003c4665bf76101dec50
Instruction ID: d52e285c1920c75d1dfbcd52b7337930c4c6c07321eb137c77b38d2a7c9bf54b
Opcode Fuzzy Hash: 102599edab9d1245af7d949caaf4fea315e2b9aba34f003c4665bf76101dec50
Instruction Fuzzy Hash: 91529C72A0AA82A5F7109B61D8803B963A1FF84BC4F644132DE4D4779DDF3CE5A4C368

Function 00007FF8A81C4980 Relevance: 77.2, APIs: 5, Strings: 39, Instructions: 243COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8A81C49B7
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C49C4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C49DC
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C49ED

Strings

SHA1, xrefs: 00007FF8A81C4D5B
MAGMA, xrefs: 00007FF8A81C4CFF
ECDHEPSK, xrefs: 00007FF8A81C4ADB
AES(256), xrefs: 00007FF8A81C4C46
GOST, xrefs: 00007FF8A81C4A9C
AESCCM8(128), xrefs: 00007FF8A81C4C9C
CHACHA20/POLY1305(256), xrefs: 00007FF8A81C4D1A
GOST94, xrefs: 00007FF8A81C4D52
any, xrefs: 00007FF8A81C4A93
unknown, xrefs: 00007FF8A81C4A43
ECDH, xrefs: 00007FF8A81C4A7C
AEAD, xrefs: 00007FF8A81C4DA2
SEED(128), xrefs: 00007FF8A81C4C22
SRP, xrefs: 00007FF8A81C4AED
..\s\ssl\ssl_ciph.c, xrefs: 00007FF8A81C49A7, 00007FF8A81C49D5
AES(128), xrefs: 00007FF8A81C4BE6
SHA384, xrefs: 00007FF8A81C4D6D
SHA256, xrefs: 00007FF8A81C4D49
None, xrefs: 00007FF8A81C4AF9
AESGCM(128), xrefs: 00007FF8A81C4C52
AESCCM(256), xrefs: 00007FF8A81C4CA5
AESCCM8(256), xrefs: 00007FF8A81C4C90
AESCCM(128), xrefs: 00007FF8A81C4CAE
GOST89(256), xrefs: 00007FF8A81C4CC0
ARIAGCM(128), xrefs: 00007FF8A81C4D11
RSAPSK, xrefs: 00007FF8A81C4AE4
ARIAGCM(256), xrefs: 00007FF8A81C4D08
GOST18, xrefs: 00007FF8A81C4AC9
KUZNYECHIK, xrefs: 00007FF8A81C4CF6
SSL_CIPHER_description, xrefs: 00007FF8A81C49C9
Camellia(128), xrefs: 00007FF8A81C4C3A
MD5, xrefs: 00007FF8A81C4D64
AESGCM(256), xrefs: 00007FF8A81C4CB7
Camellia(256), xrefs: 00007FF8A81C4C2E
GOST2012, xrefs: 00007FF8A81C4D90
RSA, xrefs: 00007FF8A81C4A4D
PSK, xrefs: 00007FF8A81C4A73
GOST89, xrefs: 00007FF8A81C4D99
DHEPSK, xrefs: 00007FF8A81C4AD2

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_mallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_ciph.c$AEAD$AES(128)$AES(256)$AESCCM(128)$AESCCM(256)$AESCCM8(128)$AESCCM8(256)$AESGCM(128)$AESGCM(256)$ARIAGCM(128)$ARIAGCM(256)$CHACHA20/POLY1305(256)$Camellia(128)$Camellia(256)$DHEPSK$ECDH$ECDHEPSK$GOST$GOST18$GOST2012$GOST89$GOST89(256)$GOST94$KUZNYECHIK$MAGMA$MD5$None$PSK$RSA$RSAPSK$SEED(128)$SHA1$SHA256$SHA384$SRP$SSL_CIPHER_description$any$unknown
API String ID: 2261483606-1235560867
Opcode ID: 5b02cb9eeec5661b9ae98409e0076dd2500787e843868fd6a9092c6d3f127e1d
Instruction ID: 02ad6f6647f387602b475a5dc7391476fc7df5be3942cd5bf68162bcf923ab00
Opcode Fuzzy Hash: 5b02cb9eeec5661b9ae98409e0076dd2500787e843868fd6a9092c6d3f127e1d
Instruction Fuzzy Hash: EEB17EA1F0F646B5F3BA9B54A4546F86360FF903D0F954072DA4E125E88F3CE948E62C

Function 00007FF8A81CCB40 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCBA4
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCBC6
CRYPTO_free_ex_data.LIBCRYPTO-3 ref: 00007FF8A81CCBF8
OPENSSL_LH_free.LIBCRYPTO-3 ref: 00007FF8A81CCC01
X509_STORE_free.LIBCRYPTO-3 ref: 00007FF8A81CCC0A
CTLOG_STORE_free.LIBCRYPTO-3 ref: 00007FF8A81CCC16
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FF8A81CCC1F
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FF8A81CCC28
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FF8A81CCC31
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FF8A81CCC50
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FF8A81CCC63
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FF8A81CCC76
OPENSSL_sk_free.LIBCRYPTO-3 ref: 00007FF8A81CCC89
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCCB6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCCCF
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCCE8
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCD01
CRYPTO_secure_free.LIBCRYPTO-3 ref: 00007FF8A81CCD1A
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FF8A81CCD2E
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8A81CCD3B
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FF8A81CCD4F
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8A81CCD5C
EVP_CIPHER_get0_provider.LIBCRYPTO-3 ref: 00007FF8A81CCD7B
EVP_CIPHER_free.LIBCRYPTO-3 ref: 00007FF8A81CCD88
EVP_MD_get0_provider.LIBCRYPTO-3 ref: 00007FF8A81CCDAF
EVP_MD_free.LIBCRYPTO-3 ref: 00007FF8A81CCDBC
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCDF9
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCE17
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCE35
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCE5E
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCE77
CRYPTO_THREAD_lock_free.LIBCRYPTO-3 ref: 00007FF8A81CCE83
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCE9C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CCEB1

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CCB97, 00007FF8A81CCBB0, 00007FF8A81CCCA9, 00007FF8A81CCCC2, 00007FF8A81CCCDB, 00007FF8A81CCCF4, 00007FF8A81CCD0D, 00007FF8A81CCDE8, 00007FF8A81CCE05, 00007FF8A81CCE23, 00007FF8A81CCE51, 00007FF8A81CCE6A, 00007FF8A81CCE8F, 00007FF8A81CCEA7

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_free$L_sk_free$D_freeD_get0_providerL_sk_pop_free$E_free$D_lock_freeH_freeO_free_ex_dataO_secure_freeR_freeR_get0_providerX509_
String ID: ..\s\ssl\ssl_lib.c
API String ID: 234229340-1080266419
Opcode ID: d880deb2d9298275d53156e737d844acf5362dc37a70cb78887c417700b62fc2
Instruction ID: a38ab3ca86bd14a88b921627fa55e2aa8d402f4cae09955ca0aa06bd3a140f57
Opcode Fuzzy Hash: d880deb2d9298275d53156e737d844acf5362dc37a70cb78887c417700b62fc2
Instruction Fuzzy Hash: 05913E61B0AA42A0EB51EF22D5912B92721EFC5FC4F041032DE1D4B69EEF2DE541C378

Function 00007FF8A81B1ACD Relevance: 59.9, APIs: 32, Strings: 2, Instructions: 405COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A822B3B4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A822B3CC
CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FF8A822B432
ERR_new.LIBCRYPTO-3 ref: 00007FF8A822B43F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A822B457
ERR_new.LIBCRYPTO-3 ref: 00007FF8A822B4C1
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A822B4D9
ERR_new.LIBCRYPTO-3 ref: 00007FF8A822B50D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A822B525
ERR_new.LIBCRYPTO-3 ref: 00007FF8A822B5EC
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A822B604
memcpy.VCRUNTIME140 ref: 00007FF8A822B69C
memcpy.VCRUNTIME140 ref: 00007FF8A822B6CD
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A822B9E1
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A822B9F6

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8A822B3C5, 00007FF8A822B426, 00007FF8A822B450, 00007FF8A822B4D2, 00007FF8A822B51E, 00007FF8A822B5FD, 00007FF8A822B742, 00007FF8A822B888, 00007FF8A822B8B2, 00007FF8A822B9AB, 00007FF8A822B9D4, 00007FF8A822B9EC
tls_process_client_hello, xrefs: 00007FF8A822B3B9, 00007FF8A822B444, 00007FF8A822B4C6, 00007FF8A822B517, 00007FF8A822B5F1, 00007FF8A822B73B, 00007FF8A822B8AB, 00007FF8A822B99F

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$O_freememcpy$O_zalloc
String ID: ..\s\ssl\statem\statem_srvr.c$tls_process_client_hello
API String ID: 2132817427-1456301196
Opcode ID: fe31296bb74389f9af1a5b5efb65c5e411fb909f44afabc2a672daddc9d9e7d0
Instruction ID: 81c395f628472bf89a1fc868959fb903a764be4d2eb9e90511819ddc5823b8b1
Opcode Fuzzy Hash: fe31296bb74389f9af1a5b5efb65c5e411fb909f44afabc2a672daddc9d9e7d0
Instruction Fuzzy Hash: C202D662B0EA42E1F724DB25D4902BD3391EF857C0F508131DAAE07A9AEF3CE195C724

Function 00007FF8A81DEB40 Relevance: 59.7, APIs: 31, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A81B1087: ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CB75F
Part of subcall function 00007FF8A81B1087: ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CB777
Part of subcall function 00007FF8A81B1087: ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CB788

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FF8A81DEB8E
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81DEB9B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81DEBB3
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81DEBC3
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8A81DEBEE
CRYPTO_THREAD_lock_new.LIBCRYPTO-3 ref: 00007FF8A81DEC37
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81DEC4C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81DEC64
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81DEC75
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81DEC8A
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81DEC8F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81DECA7
CRYPTO_new_ex_data.LIBCRYPTO-3 ref: 00007FF8A81DECED
CRYPTO_THREAD_lock_free.LIBCRYPTO-3 ref: 00007FF8A81DECFD
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81DEDC6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81DEDDE
CRYPTO_free_ex_data.LIBCRYPTO-3 ref: 00007FF8A81DEE1D
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FF8A81DEE2B
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FF8A81DEE3C
X509_free.LIBCRYPTO-3 ref: 00007FF8A81DEE48
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FF8A81DEE5B
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81DEE74
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81DEE8D
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81DEEA6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81DEEBF
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81DEED8
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81DEEF1
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81DEF0A
CRYPTO_THREAD_lock_free.LIBCRYPTO-3 ref: 00007FF8A81DEF16
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FF8A81DEF2F
memcpy.VCRUNTIME140 ref: 00007FF8A81DEF47

Strings

SSL_SESSION_new, xrefs: 00007FF8A81DEBA0, 00007FF8A81DEC51
..\s\ssl\ssl_sess.c, xrefs: 00007FF8A81DEB82, 00007FF8A81DEBAC, 00007FF8A81DEC5D, 00007FF8A81DEC80, 00007FF8A81DECA0, 00007FF8A81DEDD7, 00007FF8A81DEE67, 00007FF8A81DEE80, 00007FF8A81DEE99, 00007FF8A81DEEB2, 00007FF8A81DEECB, 00007FF8A81DEEE4, 00007FF8A81DEEFD, 00007FF8A81DEF21
ssl_get_new_session, xrefs: 00007FF8A81DEC94, 00007FF8A81DEDCB

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_free$R_newR_set_debug$R_set_error$D_lock_freeL_cleanse$D_lock_newL_sk_pop_freeO_clear_freeO_free_ex_dataO_new_ex_dataO_zallocX509_free_time64memcpy
String ID: ..\s\ssl\ssl_sess.c$SSL_SESSION_new$ssl_get_new_session
API String ID: 2281621947-2527649602
Opcode ID: 95ddfd2d6622c0488ef3d8d09f663b5d1dbe99b8f76b901feb038eb3a67387ac
Instruction ID: 757fbd5382b3e9414a25fdb7b1ec68ee58f1782c7cc3a20152d2fb753573f986
Opcode Fuzzy Hash: 95ddfd2d6622c0488ef3d8d09f663b5d1dbe99b8f76b901feb038eb3a67387ac
Instruction Fuzzy Hash: 20B18C65B0AA82A2EB45EF22D8557F82365FB84BC4F444035D91D4B29AEF3CE544C738

Function 00007FF8A81B1992 Relevance: 58.0, APIs: 31, Strings: 2, Instructions: 255COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CD32F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CD347
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CD357
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CD381
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CD399
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CD3AA
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CD3AF
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CD3C7
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CD3D8
CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FF8A81CD411
CRYPTO_THREAD_lock_new.LIBCRYPTO-3 ref: 00007FF8A81CD428
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CD439
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CD451
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CD462
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CD477
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FF8A81CD499
OPENSSL_LH_new.LIBCRYPTO-3 ref: 00007FF8A81CD510
X509_STORE_new.LIBCRYPTO-3 ref: 00007FF8A81CD522
CTLOG_STORE_new_ex.LIBCRYPTO-3 ref: 00007FF8A81CD53A
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FF8A81CD5CE
X509_VERIFY_PARAM_new.LIBCRYPTO-3 ref: 00007FF8A81CD5DB
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FF8A81CD61E
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FF8A81CD633
CRYPTO_new_ex_data.LIBCRYPTO-3 ref: 00007FF8A81CD657
CRYPTO_secure_zalloc.LIBCRYPTO-3 ref: 00007FF8A81CD676
RAND_bytes_ex.LIBCRYPTO-3 ref: 00007FF8A81CD6CB
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FF8A81CD6E5
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FF8A81CD703
RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FF8A81CD728
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CD786
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CD79E

Strings

SSL_CTX_new_ex, xrefs: 00007FF8A81CD334, 00007FF8A81CD386, 00007FF8A81CD3B4, 00007FF8A81CD43E, 00007FF8A81CD78B
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CD340, 00007FF8A81CD392, 00007FF8A81CD3C0, 00007FF8A81CD405, 00007FF8A81CD44A, 00007FF8A81CD46D, 00007FF8A81CD48F, 00007FF8A81CD66A, 00007FF8A81CD797

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$R_set_error$D_priv_bytes_ex$L_sk_new_nullX509_$D_bytes_exD_lock_newE_newE_new_exH_newL_sk_numM_newO_freeO_new_ex_dataO_secure_zallocO_strdupO_zalloc
String ID: ..\s\ssl\ssl_lib.c$SSL_CTX_new_ex
API String ID: 864562269-27091654
Opcode ID: 0ef21fb0b24aa75d52d15136eef25518695f37dfed3ffb2822b27bc7d2223680
Instruction ID: 57f1351140598772db4793cf4cbdf0ecc1b86637ae2d4595b5bc8aaa5e5aa634
Opcode Fuzzy Hash: 0ef21fb0b24aa75d52d15136eef25518695f37dfed3ffb2822b27bc7d2223680
Instruction Fuzzy Hash: 6DC1BEA1A1A742A1F752EB61E8527F92294EF847C8F480435DE4D4A7CAEF3CE450C339

Function 00007FF8A81C7980 Relevance: 51.7, APIs: 25, Strings: 4, Instructions: 927COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A81C56E0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A81C5716
Part of subcall function 00007FF8A81C56E0: ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C57E0
Part of subcall function 00007FF8A81C56E0: ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C57F8
Part of subcall function 00007FF8A81C56E0: ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C5809

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8A81C7A67
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C7A79
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C7A91
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C7AA1

Strings

ALL:!COMPLEMENTOFDEFAULT:!eNULL, xrefs: 00007FF8A81C840E
..\s\ssl\ssl_ciph.c, xrefs: 00007FF8A81C7A5C, 00007FF8A81C7A8A, 00007FF8A81C8041, 00007FF8A81C8293, 00007FF8A81C82BC, 00007FF8A81C82DC, 00007FF8A81C8459, 00007FF8A81C8473, 00007FF8A81C849C, 00007FF8A81C8554, 00007FF8A81C85C1
ssl_create_cipher_list, xrefs: 00007FF8A81C7A7E, 00007FF8A81C82D0
DEFAULT, xrefs: 00007FF8A81C83BC

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_mallocstrncmp
String ID: ..\s\ssl\ssl_ciph.c$ALL:!COMPLEMENTOFDEFAULT:!eNULL$DEFAULT$ssl_create_cipher_list
API String ID: 3221604530-3764566645
Opcode ID: 21b4a7d566a0b9a1864755d979d103a93e83fc87563cd864fd66615567e16f39
Instruction ID: 5d3a3c1f9b52dce5f428443c2a333162bd842a1d9db69c5432b65203c28b29a0
Opcode Fuzzy Hash: 21b4a7d566a0b9a1864755d979d103a93e83fc87563cd864fd66615567e16f39
Instruction Fuzzy Hash: 73828BB2A0AB46A1DA9ACF49A4806B873E0FB54BC4F288436DF0D47344DF7DD951C768

Function 00007FF8A81B1AD7 Relevance: 44.1, APIs: 23, Strings: 2, Instructions: 341COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F3B77
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F3B8F
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F3BE3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F3BFB

Strings

do_dtls1_write, xrefs: 00007FF8A81F3B7C, 00007FF8A81F3BE8, 00007FF8A81F3C67, 00007FF8A81F3D2E, 00007FF8A81F3DC5, 00007FF8A81F3E4D, 00007FF8A81F3EEF, 00007FF8A81F3F64
..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FF8A81F3B88, 00007FF8A81F3BF4, 00007FF8A81F3C73, 00007FF8A81F3D3A, 00007FF8A81F3DD1, 00007FF8A81F3E59, 00007FF8A81F3EFB, 00007FF8A81F3F70

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\record\rec_layer_d1.c$do_dtls1_write
API String ID: 193678381-4025505965
Opcode ID: a7c7b7fc5af5383dc9e08314b4fe858693127c5e4806d23078acf27cddb7bcef
Instruction ID: 718f499fe0301e472fc358fd6034d98a25f3d2637327584781d96d268d784d3b
Opcode Fuzzy Hash: a7c7b7fc5af5383dc9e08314b4fe858693127c5e4806d23078acf27cddb7bcef
Instruction Fuzzy Hash: 63F19932B0AA82A6E725DB65D8007FD33A0FB847C8F444136DE4E57699DF38E849C724

Function 00007FF8A81B1B18 Relevance: 44.1, APIs: 23, Strings: 2, Instructions: 310COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8201975
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A820198D
memset.VCRUNTIME140 ref: 00007FF8A82019D4
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8201A07
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8201A1F
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8201A82
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8201A9A
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8201AC5
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FF8A8201B2E
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8201B68
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FF8A8201B84
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8201B9C
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8201BAB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8201BC3
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FF8A8201BE4
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8201CA7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8201CBF
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8201CFA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8201D12
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8201D54
CRYPTO_memcmp.LIBCRYPTO-3 ref: 00007FF8A8201D99
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8201DF2
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8201E01

Strings

tls_construct_ctos_early_data, xrefs: 00007FF8A820197A, 00007FF8A8201A0C, 00007FF8A8201A8C, 00007FF8A8201BB0, 00007FF8A8201CAC, 00007FF8A8201D04
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8A8201986, 00007FF8A8201A18, 00007FF8A8201A93, 00007FF8A8201B5B, 00007FF8A8201B72, 00007FF8A8201BBC, 00007FF8A8201CB8, 00007FF8A8201D0B

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_new$R_set_debug$L_cleanse$O_freeO_memcmpO_memdupmemset
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_early_data
API String ID: 1127568407-4186250837
Opcode ID: c5a19426b107fa456073ed578f30350b7f7ef2be0bf41cf037068ba93a4618df
Instruction ID: a76941c51d8ad060599896ce36944f52f1573254fe349617e912493ffcf6bed0
Opcode Fuzzy Hash: c5a19426b107fa456073ed578f30350b7f7ef2be0bf41cf037068ba93a4618df
Instruction Fuzzy Hash: 2BD19E21A0E686A6FB619B61D4443FA22A8EF847C4F544031ED9E477DDEF3CE945C328

Function 00007FF8A81B1A23 Relevance: 43.9, APIs: 23, Strings: 2, Instructions: 199COMMON

Download Yara Rule

APIs

BN_dup.LIBCRYPTO-3 ref: 00007FF8A81F2E37
BN_dup.LIBCRYPTO-3 ref: 00007FF8A81F2E67
BN_dup.LIBCRYPTO-3 ref: 00007FF8A81F2E95
BN_dup.LIBCRYPTO-3 ref: 00007FF8A81F2EB6
BN_dup.LIBCRYPTO-3 ref: 00007FF8A81F2ED7
BN_dup.LIBCRYPTO-3 ref: 00007FF8A81F2EF4
BN_dup.LIBCRYPTO-3 ref: 00007FF8A81F2F14
BN_dup.LIBCRYPTO-3 ref: 00007FF8A81F2F34
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FF8A81F2F90
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FF8A81F2FD0
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F2FF3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F3009
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81F3017
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81F302C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81F3045
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F304D
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F3056
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F3062
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F306E
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F307A
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F3086
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F308E
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F309A

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FF8A81F2F89, 00007FF8A81F2FC9, 00007FF8A81F3002, 00007FF8A81F301F, 00007FF8A81F3038
ssl_srp_ctx_init_intern, xrefs: 00007FF8A81F2FF8

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: N_dupN_free$O_freeO_strdup$R_newR_set_debugR_set_error
String ID: ..\s\ssl\tls_srp.c$ssl_srp_ctx_init_intern
API String ID: 2354240759-1794268454
Opcode ID: c98abb5af24d66d9a004150ee76f33fb4d169395e3b77ac11ed95962e5c191e9
Instruction ID: 490176e465fdbefc550d470dc9890824ee4207beee027fc1ba103a64cc04685d
Opcode Fuzzy Hash: c98abb5af24d66d9a004150ee76f33fb4d169395e3b77ac11ed95962e5c191e9
Instruction Fuzzy Hash: F1A16D22A1BB82A1EB55DF24C4507F83360FF84B88F584136EE5D4739AEF68E595C324

Function 00007FF8A81B1AB4 Relevance: 42.3, APIs: 21, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8216131
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8216158
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8216289
ERR_new.LIBCRYPTO-3 ref: 00007FF8A821629E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82162B6
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8216376
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FF8A82163A1
ERR_new.LIBCRYPTO-3 ref: 00007FF8A821643E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8216456
ERR_new.LIBCRYPTO-3 ref: 00007FF8A821646B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8216483
ERR_new.LIBCRYPTO-3 ref: 00007FF8A82164A4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82164BC

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FF8A8216365, 00007FF8A8216394
tls_process_certificate_request, xrefs: 00007FF8A82162A3, 00007FF8A82162EB, 00007FF8A8216443, 00007FF8A8216470, 00007FF8A82164A9, 00007FF8A821654E
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A8216124, 00007FF8A821613D, 00007FF8A821627C, 00007FF8A82162AF, 00007FF8A82162CF, 00007FF8A82162F7, 00007FF8A821644F, 00007FF8A821647C, 00007FF8A82164B5, 00007FF8A8216555

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_freeR_newR_set_debug$O_memdup
String ID: ..\s\ssl\statem\statem_clnt.c$D:\a\1\s\include\internal/packet.h$tls_process_certificate_request
API String ID: 1088637640-3868612116
Opcode ID: b3d4ee72d450c4104bcc45599041352343e93147c58bf1fe3bb4d88c0e6ca00e
Instruction ID: ebf152b53fc0a71528839202edf2dd3e3571932ff7263a9577fa6a591b83d032
Opcode Fuzzy Hash: b3d4ee72d450c4104bcc45599041352343e93147c58bf1fe3bb4d88c0e6ca00e
Instruction Fuzzy Hash: F3D1AF72E1AA86A5F7209B61D8416FD23A4FB44BC8F144135DE8D17A9EDF3CE180C768

Function 00007FF8A8229B30 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,?,00007FF8A822BCC9), ref: 00007FF8A8229B78
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,00007FF8A822BCC9), ref: 00007FF8A8229B90
ERR_new.LIBCRYPTO-3(?,?,?,?,?,00007FF8A822BCC9), ref: 00007FF8A8229BC1
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,00007FF8A822BCC9), ref: 00007FF8A8229BD9
EVP_PKEY_CTX_free.LIBCRYPTO-3(?,?,?,?,?,00007FF8A822BCC9), ref: 00007FF8A8229E16

Strings

, xrefs: 00007FF8A8229B5C
, xrefs: 00007FF8A8229CFD
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8A8229B89, 00007FF8A8229BD2, 00007FF8A8229C28, 00007FF8A8229C7D, 00007FF8A8229CBF, 00007FF8A8229D23, 00007FF8A8229D7E, 00007FF8A8229DD4
tls_process_cke_gost18, xrefs: 00007FF8A8229B7D, 00007FF8A8229BC6, 00007FF8A8229C1C, 00007FF8A8229C71, 00007FF8A8229CB3, 00007FF8A8229D17, 00007FF8A8229D72, 00007FF8A8229DC8

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$X_free
String ID: $ $..\s\ssl\statem\statem_srvr.c$tls_process_cke_gost18
API String ID: 1470995052-4050591057
Opcode ID: 5b3c2a2a09d53af87e15bfb03ead91d3a04a26f3d1e54f3233eba0e1f7874035
Instruction ID: 22646e42c0b7fb9783500ca1d29689adce23f1b78a8782f40d11dbf8673209fe
Opcode Fuzzy Hash: 5b3c2a2a09d53af87e15bfb03ead91d3a04a26f3d1e54f3233eba0e1f7874035
Instruction Fuzzy Hash: 40816A22B1E682A5F764EB25E816AF92255EFC47C0F904132DD5D03A9AEF3CE504C768

Function 00007FF8A81B1A05 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 283COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C097D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C0995
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C09A7
ASN1_item_free.LIBCRYPTO-3 ref: 00007FF8A81C09B6
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C0A02
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C0A1A
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C0A43
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C0A5B
memcpy.VCRUNTIME140 ref: 00007FF8A81C0AC5
memcpy.VCRUNTIME140 ref: 00007FF8A81C0AFF
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8A81C0B1B
X509_free.LIBCRYPTO-3 ref: 00007FF8A81C0B4E
memcpy.VCRUNTIME140 ref: 00007FF8A81C0B89
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81C0C17
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C0C5D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C0C75

Part of subcall function 00007FF8A81C14E0: CRYPTO_free.LIBCRYPTO-3(00000000,00007FF8A81C0BB6), ref: 00007FF8A81C150E
Part of subcall function 00007FF8A81C14E0: CRYPTO_strndup.LIBCRYPTO-3(00000000,00007FF8A81C0BB6), ref: 00007FF8A81C1531

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81C0CE0
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81C0D49
ASN1_item_free.LIBCRYPTO-3 ref: 00007FF8A81C0D9B

Strings

d2i_SSL_SESSION, xrefs: 00007FF8A81C0982, 00007FF8A81C0A07, 00007FF8A81C0A48, 00007FF8A81C0C62
..\s\ssl\ssl_asn1.c, xrefs: 00007FF8A81C098E, 00007FF8A81C0A13, 00007FF8A81C0A54, 00007FF8A81C0BF4, 00007FF8A81C0C6E, 00007FF8A81C0CBA, 00007FF8A81C0D2F

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_freeR_newR_set_debug$memcpy$N1_item_free$O_strndupR_set_errorX509_free_time64
String ID: ..\s\ssl\ssl_asn1.c$d2i_SSL_SESSION
API String ID: 1562032665-384499812
Opcode ID: f2b67360e93cc7c251f19407536e2c8d2d71b12425aaf939140afabcc349f3e2
Instruction ID: 65ebd2adaf74f3c72a14c58d21d427748b7d361dbb7cd274cae01a26e4f2f07d
Opcode Fuzzy Hash: f2b67360e93cc7c251f19407536e2c8d2d71b12425aaf939140afabcc349f3e2
Instruction Fuzzy Hash: 00D10BA2A0AB82A2EB96DF25D5913B833A4FB84BC4F444035DF5D47799DF38E550C328

Function 00007FF8A821A930 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3(?,00007FF8A8219E38), ref: 00007FF8A821A96B
ERR_new.LIBCRYPTO-3(?,00007FF8A8219E38), ref: 00007FF8A821A978
ERR_set_debug.LIBCRYPTO-3(?,00007FF8A8219E38), ref: 00007FF8A821A98E
ERR_set_error.LIBCRYPTO-3(?,00007FF8A8219E38), ref: 00007FF8A821A99E
CRYPTO_malloc.LIBCRYPTO-3(?,00007FF8A8219E38), ref: 00007FF8A821A9BF
ERR_new.LIBCRYPTO-3(?,00007FF8A8219E38), ref: 00007FF8A821A9CC
ERR_set_debug.LIBCRYPTO-3(?,00007FF8A8219E38), ref: 00007FF8A821A9E2
ERR_set_error.LIBCRYPTO-3(?,00007FF8A8219E38), ref: 00007FF8A821A9F2
CRYPTO_free.LIBCRYPTO-3(?,00007FF8A8219E38), ref: 00007FF8A821AA05

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FF8A821A95D, 00007FF8A821A987, 00007FF8A821A9B5, 00007FF8A821A9DB, 00007FF8A821A9FB, 00007FF8A821AA25, 00007FF8A821AA48, 00007FF8A821AA6B
dtls1_hm_fragment_new, xrefs: 00007FF8A821A97D, 00007FF8A821A9D1, 00007FF8A821AA3E

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_freeO_mallocO_zalloc
String ID: ..\s\ssl\statem\statem_dtls.c$dtls1_hm_fragment_new
API String ID: 116187201-3452528785
Opcode ID: fe3d50635c5dad81642564eacd2de79c024f78d0fdea9b7383dc89e421b6f0e8
Instruction ID: 41645cd8587431f03b54dc905f7594348bfcf15140039e6c9c613b55bd466c00
Opcode Fuzzy Hash: fe3d50635c5dad81642564eacd2de79c024f78d0fdea9b7383dc89e421b6f0e8
Instruction Fuzzy Hash: AA415B32A1A642B6E720EB29E5415B92360EFD47C4F940035DA4E53A9DEF3CF548C778

Function 00007FF8A81FDB60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81FDC3F
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FF8A81FDC58
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FDC86
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FDC9E
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81FDD56
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FDD7F
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FDD8E
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FDE1F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FDE37

Strings

p, xrefs: 00007FF8A81FDB80
final_server_name, xrefs: 00007FF8A81FDC8B, 00007FF8A81FDDBB, 00007FF8A81FDE29
..\s\ssl\statem\extensions.c, xrefs: 00007FF8A81FDC2B, 00007FF8A81FDC4B, 00007FF8A81FDC97, 00007FF8A81FDD49, 00007FF8A81FDDC7, 00007FF8A81FDE30

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_new$O_freeR_set_debug$O_strdup
String ID: ..\s\ssl\statem\extensions.c$final_server_name$p
API String ID: 3774429508-428839542
Opcode ID: a3e9257f2e8818161d247c39271903df726ba5826a3275d388ee6d0be3dc4edf
Instruction ID: d0ad0cd916dd7e7b48e51ea2513d26d5cbe361c5b53ee4e7d9ae5f0ffc6aa80e
Opcode Fuzzy Hash: a3e9257f2e8818161d247c39271903df726ba5826a3275d388ee6d0be3dc4edf
Instruction Fuzzy Hash: 0581B032A0A682A6EB529B25D4447F82764FB91BC4F080536DE0D077DADFBCE944C768

Function 00007FF8A81B1A41 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A822894C
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FF8A8228968
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8228980
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8228998
memcmp.VCRUNTIME140 ref: 00007FF8A82289F9
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8228A23
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8228A3B
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8228AF2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8228B0A

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8A822893F, 00007FF8A8228956, 00007FF8A8228991, 00007FF8A8228A34, 00007FF8A8228A6A, 00007FF8A8228AAE, 00007FF8A8228B03
tls_handle_alpn, xrefs: 00007FF8A8228985, 00007FF8A8228A28, 00007FF8A8228AA2, 00007FF8A8228AF7

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$O_freeO_memdupmemcmp
String ID: ..\s\ssl\statem\statem_srvr.c$tls_handle_alpn
API String ID: 2318126703-2192547331
Opcode ID: 1b4f6adfb6fb3290d486012925d32bd95aa5d00e0c2047962478a8a2109de9cd
Instruction ID: ac3e45cb5624eff3ccb1c2cf2335c1ba4c6ce0797caa54de040c2e0ef6d8731d
Opcode Fuzzy Hash: 1b4f6adfb6fb3290d486012925d32bd95aa5d00e0c2047962478a8a2109de9cd
Instruction Fuzzy Hash: 6C61D172B0A682A5E751EF25E4006F96394FBC4BC4F480032DE9C477A9EF38E195C728

Function 00007FF8A81B1997 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81BF323
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81BF33B
EVP_PKEY_CTX_new_from_pkey.LIBCRYPTO-3 ref: 00007FF8A81BF371
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8A81BF3BC
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81BF3C9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81BF3E1
CRYPTO_clear_free.LIBCRYPTO-3 ref: 00007FF8A81BF497
EVP_PKEY_CTX_free.LIBCRYPTO-3 ref: 00007FF8A81BF49F

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FF8A81BF334, 00007FF8A81BF3AF, 00007FF8A81BF3DA, 00007FF8A81BF461, 00007FF8A81BF487
ssl_decapsulate, xrefs: 00007FF8A81BF328, 00007FF8A81BF3CE, 00007FF8A81BF45A

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$O_clear_freeO_mallocX_freeX_new_from_pkey
String ID: ..\s\ssl\s3_lib.c$ssl_decapsulate
API String ID: 263585440-1707435976
Opcode ID: 8c2c40e7a54a007c36c4bb2541894a11023ae1165b9564b9cf0b833faa39e4ce
Instruction ID: 5f66fe84a6cc043b7972c5f19a5265a97428915dce95c76929869f1578d722d5
Opcode Fuzzy Hash: 8c2c40e7a54a007c36c4bb2541894a11023ae1165b9564b9cf0b833faa39e4ce
Instruction Fuzzy Hash: CC41A222A0F682A5F711EB52A8155F96354EF86BD4F440032ED8D47B9AEF3CE105C7A8

Function 00007FF8A81CEC00 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CEC19
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CEC31
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CEC42
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CEC99
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CECD0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CECE8
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CECF9

Strings

SSL_clear, xrefs: 00007FF8A81CEC1E, 00007FF8A81CECD5
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CEC2A, 00007FF8A81CEC85, 00007FF8A81CECE1, 00007FF8A81CEDA0

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_free
String ID: ..\s\ssl\ssl_lib.c$SSL_clear
API String ID: 71491925-3113474232
Opcode ID: 2095472d90ff3dc08af0a84f1048bf2662dd309149ed0cc4102f33ebd4f18d4f
Instruction ID: dfdde3b2f111a1560b4a87a9bc9bf6cf7baed10d9696d75fcb3ef44de2f9866f
Opcode Fuzzy Hash: 2095472d90ff3dc08af0a84f1048bf2662dd309149ed0cc4102f33ebd4f18d4f
Instruction Fuzzy Hash: F1514E76A0AA8291E740EF21D8816BC33A4FB84BD8F484135DE5D4B6DADF38D481C738

Function 00007FF8A81B19DD Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

BN_copy.LIBCRYPTO-3 ref: 00007FF8A81F1D09
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F1D1A
BN_dup.LIBCRYPTO-3 ref: 00007FF8A81F1D2B
BN_copy.LIBCRYPTO-3 ref: 00007FF8A81F1D4B
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F1D5C
BN_dup.LIBCRYPTO-3 ref: 00007FF8A81F1D6D
BN_copy.LIBCRYPTO-3 ref: 00007FF8A81F1D8D
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F1D9E
BN_dup.LIBCRYPTO-3 ref: 00007FF8A81F1DAF
BN_copy.LIBCRYPTO-3 ref: 00007FF8A81F1DD7
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F1DE8
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81F1E25
CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FF8A81F1E3A

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FF8A81F1E1E, 00007FF8A81F1E30

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: N_copyN_free$N_dup$O_freeO_strdup
String ID: ..\s\ssl\tls_srp.c
API String ID: 3070725730-1778748169
Opcode ID: df38dbacce64862afa0680bc413e1b11140b6e2546048526193d0fc8ec849a9d
Instruction ID: 61d8837b90ebcc9b14b20a9207816daf056cf666b5265ba0f3175aaf270b6ef3
Opcode Fuzzy Hash: df38dbacce64862afa0680bc413e1b11140b6e2546048526193d0fc8ec849a9d
Instruction Fuzzy Hash: 65416725A0BA4391FB57AF1594547B832A4EF40FD4F180536DDAD0B79ADF6CA841C338

Function 00007FF8A81D5AE0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81D5B0B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81D5B23
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81D5B34
CRYPTO_realloc.LIBCRYPTO-3 ref: 00007FF8A81D5B83
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81D5B90
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81D5BA8
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81D5BB8
CRYPTO_realloc.LIBCRYPTO-3 ref: 00007FF8A81D5BDC
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81D5BE9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81D5C01
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81D5C12

Strings

dane_mtype_set, xrefs: 00007FF8A81D5B10, 00007FF8A81D5B95, 00007FF8A81D5BEE
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81D5B1C, 00007FF8A81D5B7C, 00007FF8A81D5BA1, 00007FF8A81D5BC9, 00007FF8A81D5BFA

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$O_realloc
String ID: ..\s\ssl\ssl_lib.c$dane_mtype_set
API String ID: 945340710-1331952108
Opcode ID: a5fb8cdb9169f96d0cee8378669304ac794cc4e23e31b906d06139075d0539ab
Instruction ID: 9d063eed6cba82415d9bb51f246a2b8bc1a777ddb1eecf5a8eb4be9c2c861706
Opcode Fuzzy Hash: a5fb8cdb9169f96d0cee8378669304ac794cc4e23e31b906d06139075d0539ab
Instruction Fuzzy Hash: A841E226A0A686A2E711EB21E8016F96355FF947C8F844431DE5D03B9AEF3CE441C738

Function 00007FF8A821BB70 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A821BC28
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A821BC3E
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A821BC53
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A821BCAD
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A821BCC3
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A821BCD8
memcpy.VCRUNTIME140 ref: 00007FF8A821BD5D
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A821BD73
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A821BD89
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A821BD9E

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FF8A821BC1B, 00007FF8A821BC31, 00007FF8A821BC49, 00007FF8A821BCA0, 00007FF8A821BCB6, 00007FF8A821BCCE, 00007FF8A821BD66, 00007FF8A821BD7C, 00007FF8A821BD94

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_free$memcpy
String ID: ..\s\ssl\statem\statem_dtls.c
API String ID: 1144371060-3140652063
Opcode ID: 005eac6e481a255bb56be3ad85b278dab1839147e7f3a6c68da57bdba1b2c1c7
Instruction ID: 0a8947e72a60bf32545593a21185cabf67c676521ff54ce2a889b26b0e6bd2bd
Opcode Fuzzy Hash: 005eac6e481a255bb56be3ad85b278dab1839147e7f3a6c68da57bdba1b2c1c7
Instruction Fuzzy Hash: 6C618C36B0AA42A1EB54EB1AD4512B92361FB80FD4F144036DE4D4B79DEF3DE592C328

Function 00007FF8A81C3B30 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FF8A81C3B4F
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C3B5C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C3B72
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C3B82
CRYPTO_THREAD_lock_new.LIBCRYPTO-3 ref: 00007FF8A81C3BC3
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C3BD4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C3BEC
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C3BFD
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81C3C12

Strings

ssl_cert_new, xrefs: 00007FF8A81C3B61, 00007FF8A81C3BD9
..\s\ssl\ssl_cert.c, xrefs: 00007FF8A81C3B48, 00007FF8A81C3B6B, 00007FF8A81C3BE5, 00007FF8A81C3C08

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$D_lock_newO_freeO_zalloc
String ID: ..\s\ssl\ssl_cert.c$ssl_cert_new
API String ID: 1324884158-262037048
Opcode ID: ac9b3856b89b31155a62abe4f320fdad406f86a0010b402bd73e260b736204f7
Instruction ID: 381e67db85e2a13273a0f4f1dac0820dd2cd3f6e74c277600f1b9fea3363c18b
Opcode Fuzzy Hash: ac9b3856b89b31155a62abe4f320fdad406f86a0010b402bd73e260b736204f7
Instruction Fuzzy Hash: C221B4B1B0AB42A1F742EB64D8527F93260EF44788F940035D95C0639AFF7CA585C778

Function 00007FF8A81B1C53 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81F1AD3
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81F1AEC
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F1AF8
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F1B04
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F1B10
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F1B1C
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F1B28
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F1B34
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F1B40
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F1B4C

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FF8A81F1AC6, 00007FF8A81F1ADF

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: N_free$O_free
String ID: ..\s\ssl\tls_srp.c
API String ID: 3506937590-1778748169
Opcode ID: 7b07e68a913cde0de273ed0ac5f4a265e6d35516b7a9a954a98d34e674c1fcca
Instruction ID: 62cd58fe09843fec5b7c6f7e1a771250a0a53e9f573ce00303d6a6eb3c15ca7c
Opcode Fuzzy Hash: 7b07e68a913cde0de273ed0ac5f4a265e6d35516b7a9a954a98d34e674c1fcca
Instruction Fuzzy Hash: D5210E13E1A68291F750EF35C8917FC2320EBD5B88F186631EE5D4A15AEF68A5D0C334

Function 00007FF8A81F2C10 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81F2C43
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81F2C5C
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F2C68
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F2C74
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F2C80
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F2C8C
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F2C98
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F2CA4
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F2CB0
BN_free.LIBCRYPTO-3 ref: 00007FF8A81F2CBC

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FF8A81F2C36, 00007FF8A81F2C4F

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: N_free$O_free
String ID: ..\s\ssl\tls_srp.c
API String ID: 3506937590-1778748169
Opcode ID: ee429db63b92b44f81d7029380106cb7e58cc14c187a489d3b6a82d9d9f87fd8
Instruction ID: 014ee26d26a82cdacba3a905fb3ba3c1ffe2991def29b06dc63a4f8cc7f923a9
Opcode Fuzzy Hash: ee429db63b92b44f81d7029380106cb7e58cc14c187a489d3b6a82d9d9f87fd8
Instruction Fuzzy Hash: 52210C13E1AA8291F740EF25C8917FC2320EBD5B88F186631EE5D4A15AEF68A5D0C324

Function 00007FF8A81B5C53 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 398COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FF8A81B5DE3
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81B5DF0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81B5E06
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81B5E16
BIO_set_init.LIBCRYPTO-3 ref: 00007FF8A81B5E2D
BIO_set_data.LIBCRYPTO-3 ref: 00007FF8A81B5E38
BIO_clear_flags.LIBCRYPTO-3 ref: 00007FF8A81B5E45

Strings

..\s\ssl\bio_ssl.c, xrefs: 00007FF8A81B5DDC, 00007FF8A81B5DFF
ssl_new, xrefs: 00007FF8A81B5DF5

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_clear_flagsO_set_dataO_set_initO_zallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\bio_ssl.c$ssl_new
API String ID: 3664107999-4057307684
Opcode ID: 4fe9d9adf47ecfc145edde16cadadc46be57d833d6aa4bd709a0663bcd577224
Instruction ID: acc55a93a9b9b747e10b9dde3caa3c68947962f272b60ec697d948e3a3faff0a
Opcode Fuzzy Hash: 4fe9d9adf47ecfc145edde16cadadc46be57d833d6aa4bd709a0663bcd577224
Instruction Fuzzy Hash: 99110A66B1E1C261E745EB39A8611F82711EF897D4F4C4170D79C0368BEF2CD854C714

Function 00007FF8A81C5B10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

COMP_zlib.LIBCRYPTO-3 ref: 00007FF8A81C5B1F
OPENSSL_sk_new.LIBCRYPTO-3 ref: 00007FF8A81C5B2E
COMP_get_type.LIBCRYPTO-3 ref: 00007FF8A81C5B3D
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8A81C5B6F
COMP_get_name.LIBCRYPTO-3 ref: 00007FF8A81C5B89
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FF8A81C5B9C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81C5BB5
OPENSSL_sk_sort.LIBCRYPTO-3 ref: 00007FF8A81C5BC1

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FF8A81C5B63, 00007FF8A81C5BAB

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: L_sk_newL_sk_pushL_sk_sortO_freeO_mallocP_get_nameP_get_typeP_zlib
String ID: ..\s\ssl\ssl_ciph.c
API String ID: 439358363-1847046956
Opcode ID: ca5298499ed06fed10ddc4ea8fc59caf3b95fe992f612a6575fa8e4e939db649
Instruction ID: 731e881faa246c4fe93f5f13868f5a6e4c96104636c22e6b2325618f7aca6fe8
Opcode Fuzzy Hash: ca5298499ed06fed10ddc4ea8fc59caf3b95fe992f612a6575fa8e4e939db649
Instruction Fuzzy Hash: 46114660E0AA02A2FB01EF66B9553F82695FFD4BC1F440136D91D1639AEF2CE1408738

Function 00007FF8B8F71AC0 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B8F71ADC
memset.VCRUNTIME140 ref: 00007FF8B8F71B00
RtlCaptureContext.KERNEL32 ref: 00007FF8B8F71B09
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B8F71B23
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B8F71B64
memset.VCRUNTIME140 ref: 00007FF8B8F71B97
IsDebuggerPresent.KERNEL32 ref: 00007FF8B8F71BB8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B8F71BD9
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B8F71BE4

Memory Dump Source

Source File: 00000002.00000002.3309270963.00007FF8B8F71000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000002.00000002.3309240746.00007FF8B8F70000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309322062.00007FF8B8F73000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309340812.00007FF8B8F75000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309359337.00007FF8B8F76000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8f70000_0jNz7djbpp.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 3f1457cb40ba07d85a9440bc03577fdca5d72a94ac209a419e2686ff93dec302
Instruction ID: 372240e4a723840c3152c8d070f45cb28bac4ead460dd252c934c418d831d806
Opcode Fuzzy Hash: 3f1457cb40ba07d85a9440bc03577fdca5d72a94ac209a419e2686ff93dec302
Instruction Fuzzy Hash: B5315C76608E8195FB608F68E8503ED3764FB84789F44403ADB4E47B88EF38D549C714

Function 00007FF8A81B1B31 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A820D9CB
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820D9FD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A820DA15
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820DA43
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A820DA5B

Strings

tls_parse_ctos_supported_groups, xrefs: 00007FF8A820DA02, 00007FF8A820DA48
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A820D9B9, 00007FF8A820DA0E, 00007FF8A820DA54

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$O_free
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_supported_groups
API String ID: 1233037391-3902054871
Opcode ID: 30f95744352fd8dd662230022af1eb064458d4dd2e3cb61ce782a8fa55aceb54
Instruction ID: c283efb2c4ceebc63c9feea26d4c0bbd36db258053b88fb4cbb57573595412ed
Opcode Fuzzy Hash: 30f95744352fd8dd662230022af1eb064458d4dd2e3cb61ce782a8fa55aceb54
Instruction Fuzzy Hash: A041F722F0F682A6E7618B24E5457FD67A4FB943C4F404231EA8C43A89DF3CE691C718

Function 00007FF8A81B1B90 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8A81CF0D5
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CF0E2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CF0FA
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CF10B
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CF194

Strings

SSL_client_hello_get1_extensions_present, xrefs: 00007FF8A81CF0E7
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CF0CE, 00007FF8A81CF0F3, 00007FF8A81CF18A

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_freeO_mallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_client_hello_get1_extensions_present
API String ID: 3444577743-3548336300
Opcode ID: a56876e12d39964c807f56196d92a1230fa0c8438abcbc10f6e1a163227674f9
Instruction ID: 6fa6310ddc6cb2222f9113e86cd446feebc51b05a5a2c0eaa7cab812056013ec
Opcode Fuzzy Hash: a56876e12d39964c807f56196d92a1230fa0c8438abcbc10f6e1a163227674f9
Instruction Fuzzy Hash: AB41A0B6B0BB42A2EB51CB15D8452B92361FB44BC8F948431DB0D47795EF7DE441C368

Function 00007FF8A8215B10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_free.LIBCRYPTO-3 ref: 00007FF8A8215B3C
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8215BAB
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8215BC7
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8215BDF
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8215C0A

Strings

tls_process_as_hello_retry_request, xrefs: 00007FF8A8215BCC
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A8215B9E, 00007FF8A8215BD8, 00007FF8A8215BFD

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_free$R_newR_set_debugX_free
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_as_hello_retry_request
API String ID: 1348149560-64018843
Opcode ID: 213024ec94c4d53020c4a3cdbc762f6ab868902f1250f0574e6c7262abefee5e
Instruction ID: c712f3fc3a72e0a091366f749b05d634585266114093b51dacc5144b0d39e5c7
Opcode Fuzzy Hash: 213024ec94c4d53020c4a3cdbc762f6ab868902f1250f0574e6c7262abefee5e
Instruction Fuzzy Hash: 9231C022B0969192F720DB65E5003BEA364FB85BC0F504132EE8C47A8EDF2DD551CB18

Function 00007FF8A81B1A32 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8204AB6
CRYPTO_memdup.LIBCRYPTO-3 ref: 00007FF8A8204AE2
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8204B0F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8204B27

Strings

D:\a\1\s\include\internal/packet.h, xrefs: 00007FF8A8204AAF, 00007FF8A8204AD6
..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8A8204B20
tls_parse_stoc_cookie, xrefs: 00007FF8A8204B14

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_freeO_memdupR_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$D:\a\1\s\include\internal/packet.h$tls_parse_stoc_cookie
API String ID: 1971062095-124488715
Opcode ID: b1ad6ea68d2d557ef85a4ab732bcfafd8b4bd79c5b116be8b9ddc289d91a6fca
Instruction ID: 68820d5b3ab51c39e280d648d7f7033710562f606fcd5e7afa57af4f8da09755
Opcode Fuzzy Hash: b1ad6ea68d2d557ef85a4ab732bcfafd8b4bd79c5b116be8b9ddc289d91a6fca
Instruction Fuzzy Hash: 6231E522F1EA9192E7109F25E4516B973A0FB887C8F544131EB9C43759EF3CE6A1C718

Function 00007FF8A81C5A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

OPENSSL_sk_new.LIBCRYPTO-3 ref: 00007FF8A81C5A2E
COMP_get_type.LIBCRYPTO-3 ref: 00007FF8A81C5A3D
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8A81C5A6B
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FF8A81C5A98
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81C5AB1
OPENSSL_sk_sort.LIBCRYPTO-3 ref: 00007FF8A81C5ABD

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FF8A81C5A5F, 00007FF8A81C5AA7

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: L_sk_newL_sk_pushL_sk_sortO_freeO_mallocP_get_type
String ID: ..\s\ssl\ssl_ciph.c
API String ID: 2104156618-1847046956
Opcode ID: eef5b8276f723590ae552029806c1d764aadef3c947d5a7e729dc9ea54875f5f
Instruction ID: b9343ab7f7a1443959f489e6fdb46b9e9cd2ade3db6b78d88130c7674117c469
Opcode Fuzzy Hash: eef5b8276f723590ae552029806c1d764aadef3c947d5a7e729dc9ea54875f5f
Instruction Fuzzy Hash: C2112860E0A602A2FB01EB66A9553F82295EFD4BC1F440032E91C4779AFF2DE5508238

Function 00007FF8A81C6990 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_run_once.LIBCRYPTO-3 ref: 00007FF8A81C69F7
OPENSSL_sk_find.LIBCRYPTO-3 ref: 00007FF8A81C6A1F
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FF8A81C6A31
EVP_CIPHER_fetch.LIBCRYPTO-3 ref: 00007FF8A81C6AAE
EVP_CIPHER_get_flags.LIBCRYPTO-3 ref: 00007FF8A81C6BAD

Strings

NULL, xrefs: 00007FF8A81C6AA4

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: D_run_onceL_sk_findL_sk_valueR_fetchR_get_flags
String ID: NULL
API String ID: 186275343-324932091
Opcode ID: 96dbb3e44e6d8595a7ef43a1074c1e4d25d4eb8f3a87006026facb1582cd581d
Instruction ID: f4513337e6895dc96d78fe830ec189288c8c21da069da82bff3035a54f428d77
Opcode Fuzzy Hash: 96dbb3e44e6d8595a7ef43a1074c1e4d25d4eb8f3a87006026facb1582cd581d
Instruction Fuzzy Hash: 0F916DB1A0A642A6FB628F11D8543B933A0EF44BD4F95853ADB9D46785DF3CE841C32C

Function 00007FF8A81B195B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FF8A81E4E2B
EVP_MAC_free.LIBCRYPTO-3 ref: 00007FF8A81E4EA0
EVP_MAC_CTX_free.LIBCRYPTO-3 ref: 00007FF8A81E4EBB
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81E4ED8

Strings

HMAC, xrefs: 00007FF8A81E4E76
..\s\ssl\t1_lib.c, xrefs: 00007FF8A81E4E1B, 00007FF8A81E4ECE

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: C_freeO_freeO_zallocX_free
String ID: ..\s\ssl\t1_lib.c$HMAC
API String ID: 1369405219-2203423191
Opcode ID: 99c0f417389e3b353b54abd066b1e68878303dbd4918a570d850ad37f43cb307
Instruction ID: 52d377baa1b90dec3f1a0575edd07c04c7b66c3aa46c466ce3a6a77d3e104ea6
Opcode Fuzzy Hash: 99c0f417389e3b353b54abd066b1e68878303dbd4918a570d850ad37f43cb307
Instruction Fuzzy Hash: DB214411B0BA4265EA55DB56F44157D5390FF88BC0F440036EA5E47799FF2CE581C724

Function 00007FF8A81B4BD0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FF8A81B4C0D
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81B4C1A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81B4C32
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81B4C43

Strings

WPACKET_start_sub_packet_len__, xrefs: 00007FF8A81B4C1F
..\s\crypto\packet.c, xrefs: 00007FF8A81B4C01, 00007FF8A81B4C2B

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_zallocR_newR_set_debugR_set_error
String ID: ..\s\crypto\packet.c$WPACKET_start_sub_packet_len__
API String ID: 3755831613-182491764
Opcode ID: c24971b285db655ec1f09dd86150250d1c9e63bb8f1a94002749296bda690d79
Instruction ID: 72e018ad5e619eb3d5f12330bfcca484b2c139de89b16f7c98fc9ae6edda93b6
Opcode Fuzzy Hash: c24971b285db655ec1f09dd86150250d1c9e63bb8f1a94002749296bda690d79
Instruction Fuzzy Hash: 7D21E262B0AB4191EB49DB14EA453B863A8FF58BC4F444131DA5C43799EF3CDDA0C358

Function 00007FF8A81B193D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8A81B9487
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81B9494
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81B94AC
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81B94BD

Strings

..\s\ssl\pqueue.c, xrefs: 00007FF8A81B947D, 00007FF8A81B94A5
pitem_new, xrefs: 00007FF8A81B9499

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_mallocR_newR_set_debugR_set_error
String ID: ..\s\ssl\pqueue.c$pitem_new
API String ID: 2261483606-3588450676
Opcode ID: 2447197149105a9a7f2e62b8085106e6dc276fbd0a93872979345275ebd51390
Instruction ID: 67faf73dd78e399ddf409f599ef250bcdf7dc136aa8ca31840223e031e7c57b9
Opcode Fuzzy Hash: 2447197149105a9a7f2e62b8085106e6dc276fbd0a93872979345275ebd51390
Instruction Fuzzy Hash: 2601B172B1AB41A5E780DB15E8417F833A4EB487C0F944036EA1C4379AEF3CE644CB14

Function 00007FF8A81B4B10 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3 ref: 00007FF8A81B4B39
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81B4B46
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81B4B5E
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81B4B6F

Strings

WPACKET_start_sub_packet_len__, xrefs: 00007FF8A81B4B4B
..\s\crypto\packet.c, xrefs: 00007FF8A81B4B2F, 00007FF8A81B4B57

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_zallocR_newR_set_debugR_set_error
String ID: ..\s\crypto\packet.c$WPACKET_start_sub_packet_len__
API String ID: 3755831613-182491764
Opcode ID: 1e86a7e218a2b9a8da94cbb508a3880bb7488e5f87c8f8817e4e08ba21853980
Instruction ID: 66d51ca50c4077e6f238f5fcb4ac95463b708c8ad300c91595a5b75536144c59
Opcode Fuzzy Hash: 1e86a7e218a2b9a8da94cbb508a3880bb7488e5f87c8f8817e4e08ba21853980
Instruction Fuzzy Hash: 150171A2A06B4191E704EB60E8553B932A4FB58BC4F944134D90C47795EF3DDAD5C364

Function 00007FF8A81F8A90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8A81F8B20
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F8B2F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F8B47

Strings

..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FF8A81F8B09, 00007FF8A81F8B40
ssl3_setup_read_buffer, xrefs: 00007FF8A81F8B34

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_mallocR_newR_set_debug
String ID: ..\s\ssl\record\ssl3_buffer.c$ssl3_setup_read_buffer
API String ID: 4191474876-3943321158
Opcode ID: 7179749567c24ff9b156b58983e49f78a4e1d6337738c05156663fbc9d39120b
Instruction ID: 1262e1be94686b6fcfc442a3a697db1e7c85221af2ea845d0d186fd029ad4ed0
Opcode Fuzzy Hash: 7179749567c24ff9b156b58983e49f78a4e1d6337738c05156663fbc9d39120b
Instruction Fuzzy Hash: 4621F672F1A75192FB519724E8417A822A0FB48BC0F440131EE5C43795DF7CDC92C758

Function 00007FF8A8206C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

CRYPTO_realloc.LIBCRYPTO-3(?,?,?,00007FF8A8206F5A,?,?,?,00007FF8A8206A2E), ref: 00007FF8A8206D55

Strings

..\s\ssl\statem\extensions_cust.c, xrefs: 00007FF8A8206D4E
t3, xrefs: 00007FF8A8206CC5
3, xrefs: 00007FF8A8206CCF

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_realloc
String ID: ..\s\ssl\statem\extensions_cust.c$3$t3
API String ID: 3931833713-171970420
Opcode ID: 9da2ee7f6ed94abba490b0466ec77b29cf4090a823a2c5c8fbc810d45b3f436b
Instruction ID: ee2e656a104a92abea3b25560dd781773d8b8919ea8cc848e6f13b0484f9f83a
Opcode Fuzzy Hash: 9da2ee7f6ed94abba490b0466ec77b29cf4090a823a2c5c8fbc810d45b3f436b
Instruction Fuzzy Hash: 4E418172A0AB8195EB648B09D884239A7F4FF487C4F548131DE8D43768DF3EE842C719

Function 00007FF8A8207A40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8207A8B
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8207AA1
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A8207AC8

Strings

..\s\ssl\statem\extensions_cust.c, xrefs: 00007FF8A8207A7E, 00007FF8A8207A94, 00007FF8A8207ABB

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions_cust.c
API String ID: 2581946324-3973221358
Opcode ID: 9486b742b922ef7872c7a8d4928c7cb15fe9ed31e87cc66f9c1e352f56a3f0e9
Instruction ID: 4a6f47eea650870ebcb82d1bcb3e78a1ac81c0f37b1ed96266d677ff7402692f
Opcode Fuzzy Hash: 9486b742b922ef7872c7a8d4928c7cb15fe9ed31e87cc66f9c1e352f56a3f0e9
Instruction Fuzzy Hash: 8D118E32B1AA42A5EB10AB15F4413BD6360FB84BC4F144036EA9C4775DDF7DD580C764

Function 00007FF8A81B1CA3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

CRYPTO_strdup.LIBCRYPTO-3 ref: 00007FF8A81CA747
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CA775

Strings

..\s\ssl\ssl_conf.c, xrefs: 00007FF8A81CA73D, 00007FF8A81CA768

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_freeO_strdup
String ID: ..\s\ssl\ssl_conf.c
API String ID: 2148955802-1527728938
Opcode ID: 1611209a176ae3b55ce8e3739aee067fd5bde5e7163b2c59ca7aaa397ffcbb6e
Instruction ID: 2fbab81f77b9ca3c46fd6085bc8dc2ba1bc8a0e144e95cc8f75f81f47ef54092
Opcode Fuzzy Hash: 1611209a176ae3b55ce8e3739aee067fd5bde5e7163b2c59ca7aaa397ffcbb6e
Instruction Fuzzy Hash: B51125F5B0A78291FB638755A18023966A1FB44BC0F084034EB9E47B59DF2DE491C31C

Function 00007FF8A81E4C28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

EVP_MAC_CTX_free.LIBCRYPTO-3 ref: 00007FF8A81E4C89
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81E4CA6

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FF8A81E4C9C

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_freeX_free
String ID: ..\s\ssl\t1_lib.c
API String ID: 2813942177-1643863364
Opcode ID: 2a3851bc6b421121bf5fc61dc6196838e5aba41983eeb31f72922d5ab2d269f7
Instruction ID: 064a28a3dafb76ff1d9b4d8d87a54b2371ec696e4452fbce26952929c264fe9a
Opcode Fuzzy Hash: 2a3851bc6b421121bf5fc61dc6196838e5aba41983eeb31f72922d5ab2d269f7
Instruction Fuzzy Hash: 86F0BE51F0B502AAFB1AAB2684493B811D0EF89BC0F644032D91D47792FF1CE581C728

Function 00007FF8A81D59F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81D5A10
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81D5A2D

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81D5A09, 00007FF8A81D5A19

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2581946324-1080266419
Opcode ID: 4ad0dbd46e3a53873decdf54c808e7085bfbce7e9fa66e66a0ba4a1ff10697f9
Instruction ID: 4130a9fa12ad52e00e5b3653c73b9bc09951d39e1dc40c5715f02d1baa432685
Opcode Fuzzy Hash: 4ad0dbd46e3a53873decdf54c808e7085bfbce7e9fa66e66a0ba4a1ff10697f9
Instruction Fuzzy Hash: 55E09A62B05602E1EB00BB36D8817A83360EB84F88F448030CA0C4B39BEF7DD644C334

Function 00007FF8A81B19E7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81F3885

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FF8A81F3878

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 2581946324-1306860146
Opcode ID: cc6244fca78a7524dd482868cb2f5aa3ca37d680b7610803850f313aa7fff9c9
Instruction ID: 5782f83125d418fecb5e69b05cd938351a07465251d5e6f03cd8df4e567e1704
Opcode Fuzzy Hash: cc6244fca78a7524dd482868cb2f5aa3ca37d680b7610803850f313aa7fff9c9
Instruction Fuzzy Hash: 26F04F16B06A42A4EB91AB66D4553B87328EBC4FC8F540132DD0D4B696DF2DD487C734

Function 00007FF8A81CE948 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81CE974

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CE96A

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2581946324-1080266419
Opcode ID: 3c1bc5ed2bfbfa9e325826b26eb4bf36f6436fbf29c652bcf3c9fc662e761251
Instruction ID: 4ac9f4e5e610e4082a3e60eea9c798ed3d496135cdac31c9ff872cb30ee0bd44
Opcode Fuzzy Hash: 3c1bc5ed2bfbfa9e325826b26eb4bf36f6436fbf29c652bcf3c9fc662e761251
Instruction Fuzzy Hash: 7FE0E592F19581A3F7A2871AF4810B96340E789BD0F980130CB5D473AAFF18D2908718

Function 00007FF8A81FDAF0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8A81FDB26

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FF8A81FDB12

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions.c
API String ID: 2581946324-1165805907
Opcode ID: 8724177c1e48e0554a0bfcb2cfd75b31f8ccabd07b616c583e81e0ae7f064d25
Instruction ID: a50b8258282e8797b8235bedabdb0d43902f4457a3432075ef6a6c5b89913efc
Opcode Fuzzy Hash: 8724177c1e48e0554a0bfcb2cfd75b31f8ccabd07b616c583e81e0ae7f064d25
Instruction Fuzzy Hash: CFE08C62B0268096F701AB55D8897E42350FB05B89FA81030D90D4BB96EF7E9586C725

Function 00007FF8A81B1A16 Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-3 ref: 00007FF8A81DDE79
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FF8A81DDEAE

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: fe72d2f47833ff62f6eb34b41bf5ce1617c7cf36ca78cf4de7d7052a520eb316
Instruction ID: 368626f4c58a0e1e7ccc0e62d431d75f7a03b54e384b707ae542f39d2400749b
Opcode Fuzzy Hash: fe72d2f47833ff62f6eb34b41bf5ce1617c7cf36ca78cf4de7d7052a520eb316
Instruction Fuzzy Hash: D611A511B0A64192EB46DF25E4847B91254FFC4BC4F184430FE4D4B69ADF1DD441C724

Function 00007FF8A81B1AC3 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_read_lock.LIBCRYPTO-3 ref: 00007FF8A81DDF59
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FF8A81DDF89

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: D_read_lockD_unlock
String ID:
API String ID: 102331797-0
Opcode ID: b71a81da3f9b22b3d16b60fdff25760f89655af6747ef49561b87cca01bfa7e4
Instruction ID: 157044770712ab1dc64d6c098f62482d68c419380fb73e9487f98d532280fae1
Opcode Fuzzy Hash: b71a81da3f9b22b3d16b60fdff25760f89655af6747ef49561b87cca01bfa7e4
Instruction Fuzzy Hash: 83F0A722B0A48252FB565B26E941BFC5250EBC4BC0F480431EE1C83686DF1CE4D28618

Function 00007FF8A81B198D Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-3 ref: 00007FF8A81CE260
CRYPTO_THREAD_unlock.LIBCRYPTO-3 ref: 00007FF8A81CE282

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: 98599c86363d3f056cccf1b243fa6d626a799a01397ef12d8bfac5c70b291642
Instruction ID: e0e7588fa0ff1ff1066d6fca8fdd241b2e5ec853a3718e9213f7c3f13fb8002b
Opcode Fuzzy Hash: 98599c86363d3f056cccf1b243fa6d626a799a01397ef12d8bfac5c70b291642
Instruction Fuzzy Hash: 6CE0E522B0968191EB41AB12F4407FD6254EB88BC4F180030FF4C4779AEF18C5808218

Function 00007FF8A81C1950 Relevance: 73.7, APIs: 37, Strings: 5, Instructions: 205COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3 ref: 00007FF8A81C1A37
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF8A81C1A48
OPENSSL_sk_set_cmp_func.LIBCRYPTO-3 ref: 00007FF8A81C1A82
BIO_s_file.LIBCRYPTO-3 ref: 00007FF8A81C1A8A
BIO_new.LIBCRYPTO-3 ref: 00007FF8A81C1A92
BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8A81C1AB4
PEM_read_bio_X509.LIBCRYPTO-3 ref: 00007FF8A81C1ACF
X509_get_subject_name.LIBCRYPTO-3 ref: 00007FF8A81C1AE5
X509_NAME_dup.LIBCRYPTO-3 ref: 00007FF8A81C1AF6
OPENSSL_sk_find.LIBCRYPTO-3 ref: 00007FF8A81C1B0D
X509_NAME_free.LIBCRYPTO-3 ref: 00007FF8A81C1B19
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FF8A81C1B26
PEM_read_bio_X509.LIBCRYPTO-3 ref: 00007FF8A81C1B41
ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8A81C1B4B
BIO_free.LIBCRYPTO-3 ref: 00007FF8A81C1B53
X509_free.LIBCRYPTO-3 ref: 00007FF8A81C1B5D
OPENSSL_sk_set_cmp_func.LIBCRYPTO-3 ref: 00007FF8A81C1B68
OPENSSL_DIR_read.LIBCRYPTO-3 ref: 00007FF8A81C1B75
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A81C1B86
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C1B95
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C1BAD
GetLastError.KERNEL32 ref: 00007FF8A81C1BB2
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C1BC9
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C1BCE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C1BE6
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C1BF7
X509_NAME_free.LIBCRYPTO-3 ref: 00007FF8A81C1C04
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C1C0B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C1C23
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C1C34
BIO_free.LIBCRYPTO-3 ref: 00007FF8A81C1C3C
X509_free.LIBCRYPTO-3 ref: 00007FF8A81C1C46
OPENSSL_sk_set_cmp_func.LIBCRYPTO-3 ref: 00007FF8A81C1C51
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C1C58
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C1C70
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C1C81
OPENSSL_DIR_end.LIBCRYPTO-3 ref: 00007FF8A81C1CD3

Strings

SSL_add_dir_cert_subjects_to_stack, xrefs: 00007FF8A81C1B9A, 00007FF8A81C1BD3, 00007FF8A81C1C5D
SSL_add_file_cert_subjects_to_stack, xrefs: 00007FF8A81C1C10
calling OPENSSL_dir_read(%s), xrefs: 00007FF8A81C1BBB
%s/%s, xrefs: 00007FF8A81C1A28
..\s\ssl\ssl_cert.c, xrefs: 00007FF8A81C1BA6, 00007FF8A81C1BDF, 00007FF8A81C1C1C, 00007FF8A81C1C69

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$L_sk_set_cmp_funcX509_$E_freeM_read_bio_O_freeX509X509_free$E_dupErrorL_sk_findL_sk_pushLastO_ctrlO_newO_s_fileO_snprintfR_clear_errorR_endR_readX509_get_subject_name_errno_stat64i32
String ID: %s/%s$..\s\ssl\ssl_cert.c$SSL_add_dir_cert_subjects_to_stack$SSL_add_file_cert_subjects_to_stack$calling OPENSSL_dir_read(%s)
API String ID: 2506108043-502574948
Opcode ID: 3e7396230678ba830db3e7ccb49d7ba82c152a1171f5fcb19e7bb87ff9ee3b0d
Instruction ID: 76a90a072631f83d10c0511fb8ca4f3469adc73848c68585d73318fa0c4b45d7
Opcode Fuzzy Hash: 3e7396230678ba830db3e7ccb49d7ba82c152a1171f5fcb19e7bb87ff9ee3b0d
Instruction Fuzzy Hash: 1F9172A1A1E68261F751EB11A4517FE6250EFC5BC4F844032EA8E4779AEF3CE505C72C

Function 00007FF8A81F0930 Relevance: 66.7, APIs: 28, Strings: 10, Instructions: 218COMMON

Download Yara Rule

APIs

EVP_KDF_fetch.LIBCRYPTO-3 ref: 00007FF8A81F09AC
EVP_MD_get0_name.LIBCRYPTO-3 ref: 00007FF8A81F09BF
EVP_KDF_CTX_new.LIBCRYPTO-3 ref: 00007FF8A81F09CC
EVP_KDF_free.LIBCRYPTO-3 ref: 00007FF8A81F09D7
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F09EE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F0A0F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F0A30
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81F0A41
EVP_KDF_CTX_free.LIBCRYPTO-3 ref: 00007FF8A81F0A49
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8A81F0A76
EVP_KDF_CTX_free.LIBCRYPTO-3 ref: 00007FF8A81F0A85
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F0A8A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F0AAB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F0ACC
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81F0ADD
OSSL_PARAM_construct_int.LIBCRYPTO-3 ref: 00007FF8A81F0AF8
OSSL_PARAM_construct_utf8_string.LIBCRYPTO-3 ref: 00007FF8A81F0B2B
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3 ref: 00007FF8A81F0B5D
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3 ref: 00007FF8A81F0B94
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3 ref: 00007FF8A81F0BC6
OSSL_PARAM_construct_octet_string.LIBCRYPTO-3 ref: 00007FF8A81F0BFF
OSSL_PARAM_construct_end.LIBCRYPTO-3 ref: 00007FF8A81F0C26
EVP_KDF_derive.LIBCRYPTO-3 ref: 00007FF8A81F0C57
EVP_KDF_CTX_free.LIBCRYPTO-3 ref: 00007FF8A81F0C61
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F0C6A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F0C8B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F0CB6
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81F0CC7

Strings

key, xrefs: 00007FF8A81F0B35
tls13_hkdf_expand, xrefs: 00007FF8A81F09FA, 00007FF8A81F0A96, 00007FF8A81F0C76
prefix, xrefs: 00007FF8A81F0B6F
data, xrefs: 00007FF8A81F0BF0
tls13 , xrefs: 00007FF8A81F0B68
digest, xrefs: 00007FF8A81F0B02
..\s\ssl\tls13_enc.c, xrefs: 00007FF8A81F0A01, 00007FF8A81F0A9D, 00007FF8A81F0C7D
mode, xrefs: 00007FF8A81F0AEC
TLS13-KDF, xrefs: 00007FF8A81F097E
label, xrefs: 00007FF8A81F0B9E

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_set_debug$M_construct_octet_string$R_newR_set_errorX_free$D_get0_nameD_get_sizeF_deriveF_fetchF_freeM_construct_endM_construct_intM_construct_utf8_stringX_new
String ID: ..\s\ssl\tls13_enc.c$TLS13-KDF$data$digest$key$label$mode$prefix$tls13 $tls13_hkdf_expand
API String ID: 2131617303-57965188
Opcode ID: c1bfe6db9c518b8f57ed47cfd29ba08204af4eda2012a5f786026bc60db0dfae
Instruction ID: 7ed98bd7911f19b53e972c17cbb3f1faac5629c13bcf8ae5acf969a656815b91
Opcode Fuzzy Hash: c1bfe6db9c518b8f57ed47cfd29ba08204af4eda2012a5f786026bc60db0dfae
Instruction Fuzzy Hash: EAA1CF62E0DA86A5F321DF24D8426F92720FF957C8F405232EE4D1765AEF38E285C324

Function 00007FF8B9F694B8 Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 382COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F69A29
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F69A5E
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F69A97

Strings

volatile, xrefs: 00007FF8B9F698CF
char, xrefs: 00007FF8B9F69588
auto, xrefs: 00007FF8B9F697EB
this , xrefs: 00007FF8B9F69971
long, xrefs: 00007FF8B9F69552
__int64, xrefs: 00007FF8B9F6975F
const, xrefs: 00007FF8B9F69887
long , xrefs: 00007FF8B9F695C7
wchar_t, xrefs: 00007FF8B9F6994A
int, xrefs: 00007FF8B9F69564
__int32, xrefs: 00007FF8B9F6976E
__int8, xrefs: 00007FF8B9F696D2
char8_t, xrefs: 00007FF8B9F697D9
signed , xrefs: 00007FF8B9F699F6
double, xrefs: 00007FF8B9F695DE
char32_t, xrefs: 00007FF8B9F699AB
__int128, xrefs: 00007FF8B9F69750
short, xrefs: 00007FF8B9F69576
unsigned , xrefs: 00007FF8B9F699E6
UNKNOWN, xrefs: 00007FF8B9F6992C
__int16, xrefs: 00007FF8B9F696C0
<unknown>, xrefs: 00007FF8B9F697CA
decltype(auto), xrefs: 00007FF8B9F69900
__w64 , xrefs: 00007FF8B9F696FC
volatile, xrefs: 00007FF8B9F698A2
void, xrefs: 00007FF8B9F6961C
float, xrefs: 00007FF8B9F6960A
bool, xrefs: 00007FF8B9F69780
char16_t, xrefs: 00007FF8B9F697B8

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: 9af3000e46094686c92b09a1ab6ba282d3ea35f814097fcec630d6e6c72122d6
Instruction ID: 3363459995a15f32c9d863d3d7aedbef8cc6ce0a6d87c25b3936c78868824cec
Opcode Fuzzy Hash: 9af3000e46094686c92b09a1ab6ba282d3ea35f814097fcec630d6e6c72122d6
Instruction Fuzzy Hash: BF025172E18B9698FB148F6DD8941BC2BB1FB063E6F506135CB0D56B9ADF2C9584C340

Function 00007FF8A81B1CB2 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3 ref: 00007FF8A81C229E
BIO_new.LIBCRYPTO-3 ref: 00007FF8A81C22A6
OPENSSL_LH_new.LIBCRYPTO-3 ref: 00007FF8A81C22C9
X509_new_ex.LIBCRYPTO-3 ref: 00007FF8A81C22EC
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C22FB
BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8A81C2319
OSSL_LIB_CTX_set0_default.LIBCRYPTO-3 ref: 00007FF8A81C2329
PEM_read_bio_X509.LIBCRYPTO-3 ref: 00007FF8A81C233F
OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FF8A81C2355
X509_get_subject_name.LIBCRYPTO-3 ref: 00007FF8A81C236B
X509_NAME_dup.LIBCRYPTO-3 ref: 00007FF8A81C237F
OPENSSL_LH_retrieve.LIBCRYPTO-3 ref: 00007FF8A81C2396
X509_NAME_free.LIBCRYPTO-3 ref: 00007FF8A81C23A3
PEM_read_bio_X509.LIBCRYPTO-3 ref: 00007FF8A81C23D8
OSSL_LIB_CTX_set0_default.LIBCRYPTO-3 ref: 00007FF8A81C23E9
BIO_free.LIBCRYPTO-3 ref: 00007FF8A81C23F1
X509_free.LIBCRYPTO-3 ref: 00007FF8A81C23FB
OPENSSL_LH_free.LIBCRYPTO-3 ref: 00007FF8A81C2403
ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8A81C240D
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C2423
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C243B
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C244C
X509_NAME_free.LIBCRYPTO-3 ref: 00007FF8A81C2454
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FF8A81C2463
OSSL_LIB_CTX_set0_default.LIBCRYPTO-3 ref: 00007FF8A81C246B
BIO_free.LIBCRYPTO-3 ref: 00007FF8A81C2473
X509_free.LIBCRYPTO-3 ref: 00007FF8A81C247D
OPENSSL_LH_free.LIBCRYPTO-3 ref: 00007FF8A81C2485

Strings

SSL_load_client_CA_file_ex, xrefs: 00007FF8A81C242D
..\s\ssl\ssl_cert.c, xrefs: 00007FF8A81C2434

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: X509_X_set0_default$E_freeH_freeM_read_bio_O_freeR_newX509X509_free$E_dupH_newH_retrieveL_sk_new_nullL_sk_pop_freeO_ctrlO_newO_s_fileR_clear_errorR_set_debugR_set_errorX509_get_subject_nameX509_new_ex
String ID: ..\s\ssl\ssl_cert.c$SSL_load_client_CA_file_ex
API String ID: 1433350638-4230349072
Opcode ID: a7320d74349ba95cad3125b0ddbbca0f0050ec3768799640f05c67585b29605e
Instruction ID: 2cc32c9b50231f649fb517067c3fbb27f27bc5291a4dfd077ef03898045ef2da
Opcode Fuzzy Hash: a7320d74349ba95cad3125b0ddbbca0f0050ec3768799640f05c67585b29605e
Instruction Fuzzy Hash: B3515D61B0F64362FB56AB66A8516BA5250EFC5BC0F440031EE6D07B8AEF2CE405C23C

Function 00007FF8A81BBB00 Relevance: 49.2, APIs: 25, Strings: 3, Instructions: 191COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBB84
EVP_MD_CTX_new.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBB8C
memset.VCRUNTIME140(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBBED
EVP_DigestInit_ex.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBC01
EVP_DigestUpdate.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBC19
EVP_DigestUpdate.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBC38
EVP_DigestUpdate.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBC55
EVP_DigestUpdate.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBC72
EVP_DigestFinal_ex.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBC8A
EVP_DigestInit_ex.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBCA2
EVP_DigestUpdate.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBCC1
EVP_DigestUpdate.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBCDC
EVP_DigestFinal_ex.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBCFB
OPENSSL_cleanse.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBD1E
ERR_new.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBD30
ERR_set_debug.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBD48
EVP_DigestFinal_ex.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBD5A
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBD71
ERR_new.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBD78
ERR_new.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBD84
ERR_new.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBD90
ERR_new.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBD9C
ERR_set_debug.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBDB4
EVP_MD_CTX_free.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBDD1
EVP_MD_CTX_free.LIBCRYPTO-3(?,00000000,?,?,?,00000000,00000000,00007FF8A81BC4CB), ref: 00007FF8A81BBDD9

Strings

ssl3_generate_key_block, xrefs: 00007FF8A81BBD3A, 00007FF8A81BBDA1
A, xrefs: 00007FF8A81BBB2E
..\s\ssl\s3_enc.c, xrefs: 00007FF8A81BBD41, 00007FF8A81BBDAD

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: Digest$Update$R_new$Final_ex$Init_exR_set_debugX_freeX_new$L_cleansememcpymemset
String ID: ..\s\ssl\s3_enc.c$A$ssl3_generate_key_block
API String ID: 4105275626-2069633906
Opcode ID: ffffbaf81f35c92a875a0dace780bc3a502f1223bace350b89c50d58c3ea538d
Instruction ID: 5c2eae096906a9a4b9c4e16e37a50a09e1e97295587b858e76b169081ff02654
Opcode Fuzzy Hash: ffffbaf81f35c92a875a0dace780bc3a502f1223bace350b89c50d58c3ea538d
Instruction Fuzzy Hash: 3871F652B0A68265FB51AB22D8852FA1354EF85BC8F440032ED5E47B9ADF3CE505C768

Function 00007FF8A81B19D8 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 271COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8214935
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A821494D
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8214A16
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8214CFE

Strings

tls_construct_client_hello, xrefs: 00007FF8A821493A, 00007FF8A8214CF0
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A8214946, 00007FF8A8214CF7

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$tls_construct_client_hello
API String ID: 193678381-3629367348
Opcode ID: c19b77ee69fccebdcada72dcc2a302fc1777bd908dd456877a71b125138a534d
Instruction ID: 74cf94787fd31ec3ccc36d21d50b978f38d4c798d17058cafc6915d87f59290a
Opcode Fuzzy Hash: c19b77ee69fccebdcada72dcc2a302fc1777bd908dd456877a71b125138a534d
Instruction Fuzzy Hash: 2DB19D71B0A68361FB51AB2298113BA2296FF81BC4F284131DE4D47ADADF3CE541837D

Function 00007FF8A81E6C80 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 366COMMON

Download Yara Rule

Strings

DSA, xrefs: 00007FF8A81E712C
RSA, xrefs: 00007FF8A81E7111
gfffffff, xrefs: 00007FF8A81E6CE7

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID: DSA$RSA$gfffffff
API String ID: 0-2263753174
Opcode ID: de93300cda38d9fab00c6d2ac7951e5a915e570a899abb6ed72b62b95e554886
Instruction ID: 03d419e791cf902ecbd715619db18136d88af8b7b684849e0ba1e03fab6e0e25
Opcode Fuzzy Hash: de93300cda38d9fab00c6d2ac7951e5a915e570a899abb6ed72b62b95e554886
Instruction Fuzzy Hash: B7D1B031A0E68367FA669A2695503BA52C5FF857C8F540832ED4E877D5FF3CE440C228

Function 00007FF8A81B1A55 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FF8A81FA107
EVP_CIPHER_get0_provider.LIBCRYPTO-3 ref: 00007FF8A81FA132
EVP_CIPHER_CTX_get_block_size.LIBCRYPTO-3 ref: 00007FF8A81FA14A
memset.VCRUNTIME140 ref: 00007FF8A81FA18B
EVP_CIPHER_get0_provider.LIBCRYPTO-3 ref: 00007FF8A81FA1C6
EVP_CipherUpdate.LIBCRYPTO-3 ref: 00007FF8A81FA1EE
OSSL_PARAM_construct_octet_ptr.LIBCRYPTO-3 ref: 00007FF8A81FA238
OSSL_PARAM_construct_end.LIBCRYPTO-3 ref: 00007FF8A81FA261
EVP_CIPHER_CTX_get_params.LIBCRYPTO-3 ref: 00007FF8A81FA290
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FA29D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FA2B5
EVP_Cipher.LIBCRYPTO-3 ref: 00007FF8A81FA2F0
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FA2FA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FA312
memmove.VCRUNTIME140 ref: 00007FF8A81FA388

Strings

ssl3_enc, xrefs: 00007FF8A81FA2A2, 00007FF8A81FA2FF
..\s\ssl\record\ssl3_record.c, xrefs: 00007FF8A81FA2AE, 00007FF8A81FA30B
tls-mac, xrefs: 00007FF8A81FA220

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: CipherR_get0_providerR_newR_set_debug$M_construct_endM_construct_octet_ptrUpdateX_get0_cipherX_get_block_sizeX_get_paramsmemmovememset
String ID: ..\s\ssl\record\ssl3_record.c$ssl3_enc$tls-mac
API String ID: 498158591-3426545738
Opcode ID: edfa38cf77493220b5f00a39213bd31510e8c999d8efc3161f2a847f00506121
Instruction ID: 1e033b173ba221562dab90e608b4f222a8129df674c008d8f859b3d02dce754f
Opcode Fuzzy Hash: edfa38cf77493220b5f00a39213bd31510e8c999d8efc3161f2a847f00506121
Instruction Fuzzy Hash: AA71A222A0EB86A1EB669B15E5017FA6364FF887C8F444132DE8D43B55EF7CE584C314

Function 00007FF8A81CA930 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CA953
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CA96B
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CA97C
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CA9E2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CA9FA
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CAA0A

Strings

ctrl_switch_option, xrefs: 00007FF8A81CA9E7
cmd=%s, value=%s, xrefs: 00007FF8A81CAB4A
<EMPTY>, xrefs: 00007FF8A81CAB40
cmd=%s, xrefs: 00007FF8A81CABA2
..\s\ssl\ssl_conf.c, xrefs: 00007FF8A81CA964, 00007FF8A81CA9F3, 00007FF8A81CAB2F, 00007FF8A81CAB91
SSL_CONF_cmd, xrefs: 00007FF8A81CA958, 00007FF8A81CAB23, 00007FF8A81CAB85

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_conf.c$<EMPTY>$SSL_CONF_cmd$cmd=%s$cmd=%s, value=%s$ctrl_switch_option
API String ID: 1552677711-2097058995
Opcode ID: d37e8bc2247db8ea39923370b579b9681b4d89a9bf636e9b0f7c3792bd37da76
Instruction ID: 05cd032ef4113e5d938a85ba2134def61d3ca1d5970a37ebca03dd9971531edb
Opcode Fuzzy Hash: d37e8bc2247db8ea39923370b579b9681b4d89a9bf636e9b0f7c3792bd37da76
Instruction Fuzzy Hash: 9A61B2A6A0E642A2FB42DB58E8512F96361EB847C4F584032DF4C43BD9DF3CD945C758

Function 00007FF8B8F72138 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 123threadtimeCOMMON

Download Yara Rule

APIs

PyThreadState_Get.PYTHON312 ref: 00007FF8B8F72165
_PyTime_FromSecondsObject.PYTHON312 ref: 00007FF8B8F72194
PyErr_SetString.PYTHON312 ref: 00007FF8B8F721B9
PyThread_acquire_lock_timed.PYTHON312 ref: 00007FF8B8F72233
PyEval_SaveThread.PYTHON312 ref: 00007FF8B8F72248
PyThread_acquire_lock_timed.PYTHON312 ref: 00007FF8B8F7225C
PyEval_RestoreThread.PYTHON312 ref: 00007FF8B8F72267
_PyEval_MakePendingCalls.PYTHON312 ref: 00007FF8B8F72275
_PyDeadline_Get.PYTHON312 ref: 00007FF8B8F7229C
_PyTime_AsMicroseconds.PYTHON312 ref: 00007FF8B8F722AF
PyThread_release_lock.PYTHON312 ref: 00007FF8B8F722DF
PyType_GetModule.PYTHON312 ref: 00007FF8B8F72311
PyErr_SetNone.PYTHON312 ref: 00007FF8B8F7231F

Strings

'timeout' must be a non-negative number, xrefs: 00007FF8B8F721AF
timeout value is too large, xrefs: 00007FF8B8F721EA

Memory Dump Source

Source File: 00000002.00000002.3309270963.00007FF8B8F71000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000002.00000002.3309240746.00007FF8B8F70000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309322062.00007FF8B8F73000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309340812.00007FF8B8F75000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309359337.00007FF8B8F76000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8f70000_0jNz7djbpp.jbxd

Similarity

API ID: Eval_Thread$Err_Thread_acquire_lock_timedTime_$CallsDeadline_FromMakeMicrosecondsModuleNoneObjectPendingRestoreSaveSecondsState_StringThread_release_lockType_
String ID: 'timeout' must be a non-negative number$timeout value is too large
API String ID: 1400298838-4256478105
Opcode ID: 024861a6106d3aa4d6ddea22c97cbfe2d1fb6628fe90f464c247d24666294212
Instruction ID: f78618e33a96c2b42624cbbcc493d7ea6e881779609162e5be75f21fd9e11d8b
Opcode Fuzzy Hash: 024861a6106d3aa4d6ddea22c97cbfe2d1fb6628fe90f464c247d24666294212
Instruction Fuzzy Hash: BC515139B08E13A2F6109B5AE8541396BA0FB88BD6F404531CF1E87B94DF7CE456C319

Function 00007FF8A81B1942 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CF859
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CF871
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CF882
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CF89E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CF8B6
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CF8C7

Strings

SSL_dane_enable, xrefs: 00007FF8A81CF85E, 00007FF8A81CF8A3, 00007FF8A81CF900, 00007FF8A81CF954, 00007FF8A81CF9C2
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CF86A, 00007FF8A81CF8AF, 00007FF8A81CF90C, 00007FF8A81CF960, 00007FF8A81CF9CE

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_dane_enable
API String ID: 1552677711-2910236719
Opcode ID: 732e637d63d256db1ddb73eaab57dc461342250b7c3bd114a68d03938ad656e2
Instruction ID: dddb7f455a0f15e1a4e70f14845c12302df22bd1c442d06ee1881578aaa8530b
Opcode Fuzzy Hash: 732e637d63d256db1ddb73eaab57dc461342250b7c3bd114a68d03938ad656e2
Instruction Fuzzy Hash: FC41B3A1B2E682B2F790DB25E8427FC2250EF847D4FD41231E62C026DAEF2CD545C768

Function 00007FF8A81E99E0 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 295COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81E9A5F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81E9A77
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8A81E9C70
EVP_PKEY_get_size.LIBCRYPTO-3 ref: 00007FF8A81E9C7F
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81E9CF4
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81E9D17
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81E9D80

Strings

gfffffff, xrefs: 00007FF8A81E9AB4
..\s\ssl\t1_lib.c, xrefs: 00007FF8A81E9A70, 00007FF8A81E9DFB, 00007FF8A81E9E47
tls_choose_sigalg, xrefs: 00007FF8A81E9A69, 00007FF8A81E9DEF, 00007FF8A81E9E3B
gfffffff, xrefs: 00007FF8A81E9CA0
gfffffff, xrefs: 00007FF8A81E9B5C

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_new$D_get_sizeR_set_debugY_get_size
String ID: ..\s\ssl\t1_lib.c$gfffffff$gfffffff$gfffffff$tls_choose_sigalg
API String ID: 2573607796-412855087
Opcode ID: c15afbe78bb01bcd70d637c6ea06af671b4bd5f70e8894de1d5a8abfe34ba7f4
Instruction ID: 6921a2bb27f451c9d1657052d91a085ccb10e4185610dc187366bf370f3e7c2c
Opcode Fuzzy Hash: c15afbe78bb01bcd70d637c6ea06af671b4bd5f70e8894de1d5a8abfe34ba7f4
Instruction Fuzzy Hash: 12C1D021B0A646A7EB2A9B22A0403B96291FF81BD4F444132DE5E477D5FF3CF452C329

Function 00007FF8B9F6CDBC Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6CE4D
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6CE86
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6CF5A
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6CF6B
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6CFCE
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6CFDE
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6D02A
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6D03C
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6D1B1

Part of subcall function 00007FF8B9F6ED94: Replicator::operator[].LIBVCRUNTIME ref: 00007FF8B9F6EDEE

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6D233
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6D242

Strings

`anonymous namespace', xrefs: 00007FF8B9F6D10E

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID: `anonymous namespace'
API String ID: 3863519203-3062148218
Opcode ID: c2c563be3abc2cd025459880134dd91d33137c93c5547e13454a58e5101b2a40
Instruction ID: 956e9d08a24cd471b88259dd6a27d2a89bd28e3e3a8110ab969681c911281239
Opcode Fuzzy Hash: c2c563be3abc2cd025459880134dd91d33137c93c5547e13454a58e5101b2a40
Instruction Fuzzy Hash: DEE15B72A08BC299EB10CF28D8801AD7BA0FB457A5F406136EB8D57B69DF3CE555C710

Function 00007FF8A82129A0 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 195COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,00000000,?,?,?,00007FF8A8214BBB), ref: 00007FF8A82129DC
ERR_set_debug.LIBCRYPTO-3(?,?,00000000,?,?,?,00007FF8A8214BBB), ref: 00007FF8A82129F4
ERR_new.LIBCRYPTO-3(?,?,00000000,?,?,?,00007FF8A8214BBB), ref: 00007FF8A8212A21
ERR_set_debug.LIBCRYPTO-3(?,?,00000000,?,?,?,00007FF8A8214BBB), ref: 00007FF8A8212A39

Strings

ssl_cipher_list_to_bytes, xrefs: 00007FF8A82129E1, 00007FF8A8212A26, 00007FF8A8212BD4, 00007FF8A8212C30
No ciphers enabled for max supported SSL/TLS version, xrefs: 00007FF8A8212C4B
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A82129ED, 00007FF8A8212A32, 00007FF8A8212BDB, 00007FF8A8212C3C

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$No ciphers enabled for max supported SSL/TLS version$ssl_cipher_list_to_bytes
API String ID: 193678381-2593539604
Opcode ID: d584ddfe7eaa467390292888a7cbf4e4318d3ca9e1b883146ba12cac7ef17471
Instruction ID: 5eb95e213d7b3f1b74276b1d86f796d4166cabae1649c2d199d4c1f396f3111e
Opcode Fuzzy Hash: d584ddfe7eaa467390292888a7cbf4e4318d3ca9e1b883146ba12cac7ef17471
Instruction Fuzzy Hash: 1F71D232B0A683A2FB11DB25E8417B92290EF84BD4F544031EE4D47AD9DF3CE981C768

Function 00007FF8A8221940 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A81B17A3: BIO_new.LIBCRYPTO-3 ref: 00007FF8A81BC23E
Part of subcall function 00007FF8A81B17A3: ERR_new.LIBCRYPTO-3 ref: 00007FF8A81BC24B
Part of subcall function 00007FF8A81B17A3: ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81BC263

ERR_new.LIBCRYPTO-3 ref: 00007FF8A822198E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82219A6
OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FF8A8221A57
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FF8A8221A69
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8221AF9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8221B11
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8221B6A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8221B82

Strings

No ciphers enabled for max supported SSL/TLS version, xrefs: 00007FF8A8221BEB
The max supported SSL/TLS version needs the MD5-SHA1 digest but it is not available in the loaded providers. Use (D)TLSv1.2 or above, or load different providers, xrefs: 00007FF8A8221B16
..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8A822199F, 00007FF8A8221B0A, 00007FF8A8221B7B, 00007FF8A8221BDF
tls_setup_handshake, xrefs: 00007FF8A8221993, 00007FF8A8221AFE, 00007FF8A8221B6F, 00007FF8A8221BD3

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$L_sk_numL_sk_valueO_new
String ID: ..\s\ssl\statem\statem_lib.c$No ciphers enabled for max supported SSL/TLS version$The max supported SSL/TLS version needs the MD5-SHA1 digest but it is not available in the loaded providers. Use (D)TLSv1.2 or above, or load different providers$tls_setup_handshake
API String ID: 2488525820-2497654048
Opcode ID: 1ea2abbcb0a5b0ea4211ad3b53fc8916c12df6fa479c93c6fe42d2783a054ee4
Instruction ID: d6a3d48db008322c7d11fad9fe84dd38f0ce1fcbbd82ddf2384d6b3a4dca1d99
Opcode Fuzzy Hash: 1ea2abbcb0a5b0ea4211ad3b53fc8916c12df6fa479c93c6fe42d2783a054ee4
Instruction Fuzzy Hash: 3491CE72A0A682A6E750DF25D4447B92360FBC4BC8F544136DE8C4769EEF3CE581C768

Function 00007FF8A81B1B81 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FF8A81FC6F4
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8A81FC6FC
EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8A81FC718
EVP_MD_CTX_ctrl.LIBCRYPTO-3 ref: 00007FF8A81FC761
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FF8A81FC802
EVP_CIPHER_get_mode.LIBCRYPTO-3 ref: 00007FF8A81FC80A
OSSL_PARAM_construct_size_t.LIBCRYPTO-3 ref: 00007FF8A81FC82F
OSSL_PARAM_construct_end.LIBCRYPTO-3 ref: 00007FF8A81FC851
EVP_MD_CTX_get_pkey_ctx.LIBCRYPTO-3 ref: 00007FF8A81FC872
EVP_PKEY_CTX_set_params.LIBCRYPTO-3 ref: 00007FF8A81FC87E
EVP_DigestSignUpdate.LIBCRYPTO-3 ref: 00007FF8A81FC894
EVP_DigestSignUpdate.LIBCRYPTO-3 ref: 00007FF8A81FC8A8
EVP_DigestSignFinal.LIBCRYPTO-3 ref: 00007FF8A81FC8BE
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8A81FC8F6

Strings

tls-data-size, xrefs: 00007FF8A81FC824

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: DigestSign$Update$D_get_sizeFinalM_construct_endM_construct_size_tR_get_modeX_ctrlX_freeX_get0_cipherX_get0_mdX_get_pkey_ctxX_newX_set_params
String ID: tls-data-size
API String ID: 2598929643-2895545602
Opcode ID: 1a7a7e676e8a85e5fd75f23676235adf632c74f96e1659e0a6875ff832f67887
Instruction ID: c7ef41c57a4dca3a035e0a50f4d25a077e4708f5a9900bb4a825790422f4ce02
Opcode Fuzzy Hash: 1a7a7e676e8a85e5fd75f23676235adf632c74f96e1659e0a6875ff832f67887
Instruction Fuzzy Hash: 4281D422E0AB82A5E712DB65D4003BD27A0FB95BC8F048132EE4D5B755EF7CE546D324

Function 00007FF8A81B1BDB Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FF8A81C203B
OPENSSL_sk_new_reserve.LIBCRYPTO-3 ref: 00007FF8A81C2046
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C2053
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C206B
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C207B
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FF8A81C20A5
X509_NAME_dup.LIBCRYPTO-3 ref: 00007FF8A81C20AD
OPENSSL_sk_push.LIBCRYPTO-3 ref: 00007FF8A81C20BD

Strings

SSL_dup_CA_list, xrefs: 00007FF8A81C2058, 00007FF8A81C20E5
..\s\ssl\ssl_cert.c, xrefs: 00007FF8A81C2064, 00007FF8A81C20F1

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: E_dupL_sk_new_reserveL_sk_numL_sk_pushL_sk_valueR_newR_set_debugR_set_errorX509_
String ID: ..\s\ssl\ssl_cert.c$SSL_dup_CA_list
API String ID: 876855465-3127325357
Opcode ID: 26c8c950f315b442794ff6ae20a326b422e549378035f92cda48f836a09ba014
Instruction ID: 7caa64b521ab4dff7d3d94c263a5fe17c994a3e94b84498b35991da076ec462e
Opcode Fuzzy Hash: 26c8c950f315b442794ff6ae20a326b422e549378035f92cda48f836a09ba014
Instruction Fuzzy Hash: 2121ED61F1E742A6F751E725A4522BE6250EF847C0F940032EA5E43B8AEF3CE851C268

Function 00007FF8B9F6DC24 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF8B9F690F4), ref: 00007FF8B9F6E08A
DName::DName.LIBVCRUNTIME ref: 00007FF8B9F6E0C9
swprintf_s.PGOCR ref: 00007FF8B9F6E0E9
DName::DName.LIBVCRUNTIME ref: 00007FF8B9F6E0F9
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6E149

Strings

`generic-method-parameter-, xrefs: 00007FF8B9F6E116
lambda, xrefs: 00007FF8B9F6DFE8
`template-type-parameter-, xrefs: 00007FF8B9F6E16A
`generic-class-parameter-, xrefs: 00007FF8B9F6E15A
NULL, xrefs: 00007FF8B9F6DCF1
nullptr, xrefs: 00007FF8B9F6DE0D

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: NameName::$Name::operator+atolswprintf_s
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 2331677841-2441609178
Opcode ID: 04052d8e5626c1f24672c52f4d573e3506f88365006a7f318b5907256fbad706
Instruction ID: 79f7f86b19698ebff7298fe6d4d46c1c29fbeabff82071bd15b53d90a85fb32b
Opcode Fuzzy Hash: 04052d8e5626c1f24672c52f4d573e3506f88365006a7f318b5907256fbad706
Instruction Fuzzy Hash: 18F1AE32E1C78298FB149F6CD9941BC2BB2AF153E6F542135CB0D26BA9DE3CA514D350

Function 00007FF8A81EEC70 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 175COMMON

Download Yara Rule

APIs

EVP_MD_get_size.LIBCRYPTO-3(?,0000077C,?,?,00007FF8A81F0FE3), ref: 00007FF8A81EEC92
ERR_new.LIBCRYPTO-3(?,0000077C,?,?,00007FF8A81F0FE3), ref: 00007FF8A81EEC9B
ERR_set_debug.LIBCRYPTO-3(?,0000077C,?,?,00007FF8A81F0FE3), ref: 00007FF8A81EECB3
EVP_CipherInit_ex.LIBCRYPTO-3(?,0000077C,?,?,00007FF8A81F0FE3), ref: 00007FF8A81EEE98
EVP_CIPHER_CTX_ctrl.LIBCRYPTO-3(?,0000077C,?,?,00007FF8A81F0FE3), ref: 00007FF8A81EEEAD

Strings

key, xrefs: 00007FF8A81EEDE2
derive_secret_key_and_iv, xrefs: 00007FF8A81EECA0, 00007FF8A81EEF02
..\s\ssl\tls13_enc.c, xrefs: 00007FF8A81EECAC, 00007FF8A81EEF09

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: CipherD_get_sizeInit_exR_newR_set_debugX_ctrl
String ID: ..\s\ssl\tls13_enc.c$derive_secret_key_and_iv$key
API String ID: 2359698082-1803617066
Opcode ID: 696a213141455faa9ff17da660913f79db2f24ba0cf6463d734fc9240239c88f
Instruction ID: 9cb98aaaf28d07e79e70ec33fe341c024f608e848e7ddd8a14ed34beb26747c0
Opcode Fuzzy Hash: 696a213141455faa9ff17da660913f79db2f24ba0cf6463d734fc9240239c88f
Instruction Fuzzy Hash: FA71B53260EB8256F761AB15A841BBA77A4FB85BC4F044135ED8D43B99EF3CE141C728

Function 00007FF8A81EBAF0 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 84COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FF8A81EBB62
BIO_printf.LIBCRYPTO-3 ref: 00007FF8A81EBB74
d2i_X509.LIBCRYPTO-3 ref: 00007FF8A81EBB83
BIO_puts.LIBCRYPTO-3 ref: 00007FF8A81EBB9A
BIO_puts.LIBCRYPTO-3 ref: 00007FF8A81EBBA8
BIO_puts.LIBCRYPTO-3 ref: 00007FF8A81EBBD6
X509_free.LIBCRYPTO-3 ref: 00007FF8A81EBBDE
BIO_puts.LIBCRYPTO-3 ref: 00007FF8A81EBC00

Strings

<TRAILING GARBAGE AFTER CERTIFICATE>, xrefs: 00007FF8A81EBBF6
------------------, xrefs: 00007FF8A81EBBCC
<UNPARSEABLE CERTIFICATE>, xrefs: 00007FF8A81EBB93
ASN.1Cert, length=%d, xrefs: 00007FF8A81EBB6A
------details-----, xrefs: 00007FF8A81EBBA1

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_puts$O_indentO_printfX509X509_freed2i_
String ID: ------details-----$------------------$<TRAILING GARBAGE AFTER CERTIFICATE>$<UNPARSEABLE CERTIFICATE>$ASN.1Cert, length=%d
API String ID: 4063798575-1858050172
Opcode ID: 527b0f517e9145397ede43d49dcb3b330cdb81a3940d9b5f37a0a9b7634a1f5e
Instruction ID: 79651d3345b8bf393b42ce58cd6c5bae7490f97afb53924fea6835f5ab5be700
Opcode Fuzzy Hash: 527b0f517e9145397ede43d49dcb3b330cdb81a3940d9b5f37a0a9b7634a1f5e
Instruction Fuzzy Hash: 0A31091270E681A6EB14EB16E8512BD6351EF85BD0F444532EE6D47B9EFF2CE001C728

Function 00007FF8A81DA9E0 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81DA9FE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81DAA14
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81DAA24
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81DAA57
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81DAA6F
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81DAA7D

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8A81DAA0D, 00007FF8A81DAA68, 00007FF8A81DB4FF
SSL_use_certificate, xrefs: 00007FF8A81DAA03, 00007FF8A81DAA5C
ssl_set_cert, xrefs: 00007FF8A81DB4F3

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_rsa.c$SSL_use_certificate$ssl_set_cert
API String ID: 1552677711-2944039091
Opcode ID: aea7a62b505d36449234635bc76e0be92653b206264229f0d9473404dc4bcce2
Instruction ID: d0b78b2b47aa8314bdea66f1f74dbe7e833d3b1c02700e5bfa92e571ebb31f50
Opcode Fuzzy Hash: aea7a62b505d36449234635bc76e0be92653b206264229f0d9473404dc4bcce2
Instruction Fuzzy Hash: 1631B266F1E642A2F741EB25E9016B96360EF887C4F944131EA4C43B9EEF2CE541CB74

Function 00007FF8A81D8B00 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81D8B30
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81D8B48
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81D8B59
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81D8B75
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81D8B8D
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81D8B9E

Strings

ssl_write_internal, xrefs: 00007FF8A81D8B35, 00007FF8A81D8B7A, 00007FF8A81D8BC7
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81D8B41, 00007FF8A81D8B86, 00007FF8A81D8BD3

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_write_internal
API String ID: 1552677711-2859347552
Opcode ID: 4debfd64f7e5eb535d8b3e052774701b7195fb8ddc569b04f70dd0001da440ca
Instruction ID: b9e7b6cf8da7937f1d4b90e755d27059cf6f16c714c0ddf9ba8a09fd897d50ed
Opcode Fuzzy Hash: 4debfd64f7e5eb535d8b3e052774701b7195fb8ddc569b04f70dd0001da440ca
Instruction Fuzzy Hash: 7D41AF31A0E646A6F750DB25E8427F93260EB84BC8F644531EA4D037EADF3CE455CB68

Function 00007FF8A81DAAF0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

X509_new_ex.LIBCRYPTO-3 ref: 00007FF8A81DAB1F
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81DAB2E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81DAB46
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81DAB57
d2i_X509.LIBCRYPTO-3 ref: 00007FF8A81DAB76
X509_free.LIBCRYPTO-3 ref: 00007FF8A81DAB85
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81DAB8A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81DABA2
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81DABB3

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8A81DAB3F, 00007FF8A81DAB9B
SSL_use_certificate_ASN1, xrefs: 00007FF8A81DAB33, 00007FF8A81DAB8F

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error$X509X509_freeX509_new_exd2i_
String ID: ..\s\ssl\ssl_rsa.c$SSL_use_certificate_ASN1
API String ID: 4137050946-3038676897
Opcode ID: c6f40b39c5523228d6602cf9bdb13ac2ed6b2d0e723d27ed7ff097313f0fdc60
Instruction ID: 818b90a1dbcf7d750220cfb5e171c6635e81d55586d65435e3970f16d3e481ba
Opcode Fuzzy Hash: c6f40b39c5523228d6602cf9bdb13ac2ed6b2d0e723d27ed7ff097313f0fdc60
Instruction Fuzzy Hash: 19217465B2E641A1EB80E725E8426BD6350EFC87C4F941032FA5D43B9EEF2CD455CB24

Function 00007FF8B9F6B280 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6B2D1
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6B39A
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6B3E3
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6B3F4

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 9a3856515ab70ac0cbef49cb78169d28014df4ca819d0bec0dbbb0bc7461e156
Instruction ID: 59767798d5f90d25f6265be4f1e77b50c0027f8b3e3931623f3e1f01ee8f6530
Opcode Fuzzy Hash: 9a3856515ab70ac0cbef49cb78169d28014df4ca819d0bec0dbbb0bc7461e156
Instruction Fuzzy Hash: ECF14676A08B829EEB11DFB8E4901FC37A1EB0439EB405136EB4D57B99DE38D519C340

Function 00007FF8A81E49D0 Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

BN_get_rfc3526_prime_8192.LIBCRYPTO-3 ref: 00007FF8A81E4A62
EVP_PKEY_CTX_new_from_name.LIBCRYPTO-3 ref: 00007FF8A81E4ABC
EVP_PKEY_fromdata_init.LIBCRYPTO-3 ref: 00007FF8A81E4ACC
OSSL_PARAM_BLD_new.LIBCRYPTO-3 ref: 00007FF8A81E4AD6
OSSL_PARAM_BLD_push_BN.LIBCRYPTO-3 ref: 00007FF8A81E4AF0
OSSL_PARAM_BLD_push_uint.LIBCRYPTO-3 ref: 00007FF8A81E4B09
OSSL_PARAM_BLD_to_param.LIBCRYPTO-3 ref: 00007FF8A81E4B15
EVP_PKEY_fromdata.LIBCRYPTO-3 ref: 00007FF8A81E4B33
OSSL_PARAM_free.LIBCRYPTO-3 ref: 00007FF8A81E4B3B
OSSL_PARAM_BLD_free.LIBCRYPTO-3 ref: 00007FF8A81E4B43
EVP_PKEY_CTX_free.LIBCRYPTO-3 ref: 00007FF8A81E4B4B
BN_free.LIBCRYPTO-3 ref: 00007FF8A81E4B53

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: D_freeD_newD_push_D_push_uintD_to_paramM_freeN_freeN_get_rfc3526_prime_8192X_freeX_new_from_nameY_fromdataY_fromdata_init
String ID:
API String ID: 2253699700-0
Opcode ID: 8a65b535e552331fa47700704d4f9052b3df7707199684ef10e6f71c7db5d69b
Instruction ID: 2a2ac8dffa2b91bcff824396c8ab550e5ba6d850f53bf3c1423339864358741f
Opcode Fuzzy Hash: 8a65b535e552331fa47700704d4f9052b3df7707199684ef10e6f71c7db5d69b
Instruction Fuzzy Hash: 61416D11B0BA42AAFB25AB6694412BC2290FFC5BD0F194136DD1E47796FF2DE502C32D

Function 00007FF8A8219A90 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

BN_bin2bn.LIBCRYPTO-3(00000000,00000000,?,?,?,00007FF8A8216C91), ref: 00007FF8A8219C1C
BN_bin2bn.LIBCRYPTO-3(00000000,00000000,?,?,?,00007FF8A8216C91), ref: 00007FF8A8219C39
BN_bin2bn.LIBCRYPTO-3(00000000,00000000,?,?,?,00007FF8A8216C91), ref: 00007FF8A8219C56
BN_bin2bn.LIBCRYPTO-3(00000000,00000000,?,?,?,00007FF8A8216C91), ref: 00007FF8A8219C6F
X509_get0_pubkey.LIBCRYPTO-3(00000000,00000000,?,?,?,00007FF8A8216C91), ref: 00007FF8A8219CA7
ERR_new.LIBCRYPTO-3(00000000,00000000,?,?,?,00007FF8A8216C91), ref: 00007FF8A8219CD0
ERR_set_debug.LIBCRYPTO-3(00000000,00000000,?,?,?,00007FF8A8216C91), ref: 00007FF8A8219CE8
ERR_new.LIBCRYPTO-3(00000000,00000000,?,?,?,00007FF8A8216C91), ref: 00007FF8A8219D06
ERR_set_debug.LIBCRYPTO-3(00000000,00000000,?,?,?,00007FF8A8216C91), ref: 00007FF8A8219D1E

Strings

tls_process_ske_srp, xrefs: 00007FF8A8219CD5, 00007FF8A8219D0B
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A8219CE1, 00007FF8A8219D17

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: N_bin2bn$R_newR_set_debug$X509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_ske_srp
API String ID: 589648786-2175212704
Opcode ID: aae21cb67a2bdc093b022af72e57035cabfd8458de464dc6f2f97cb19111c095
Instruction ID: 9bc6689aca6d498f1efc2530bd6b21bb2af47bbacae50b233e523761d71185df
Opcode Fuzzy Hash: aae21cb67a2bdc093b022af72e57035cabfd8458de464dc6f2f97cb19111c095
Instruction Fuzzy Hash: BD61C772E1DBD152E7219B25A8056BA7391FB897C4F548231EECC1265AEF3CE290C724

Function 00007FF8A81B19EC Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-3 ref: 00007FF8A820DB90
OPENSSL_sk_value.LIBCRYPTO-3 ref: 00007FF8A820DBCB
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820DBF4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A820DC0C

Strings

tls_parse_ctos_use_srtp, xrefs: 00007FF8A820DBF9, 00007FF8A820DC55, 00007FF8A820DC91, 00007FF8A820DCB9
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A820DC05, 00007FF8A820DC9D, 00007FF8A820DCC5

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: L_sk_numL_sk_valueR_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_use_srtp
API String ID: 2660725122-2269544924
Opcode ID: f325fb01198b6b57507b34d37c796a73c9f844c90a9fcc2e1d121f956633f299
Instruction ID: 4e05ed9da62c2144e0d02ad5c29fbc80e63878e84095e39a432ee74e1439fccf
Opcode Fuzzy Hash: f325fb01198b6b57507b34d37c796a73c9f844c90a9fcc2e1d121f956633f299
Instruction Fuzzy Hash: D051B172A0FB92A1E710DB51E8492BA67A5EB857D0F414236ED9C43789EF7CE440C728

Function 00007FF8A81B1C21 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

BIO_method_type.LIBCRYPTO-3 ref: 00007FF8A81D4199
BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8A81D41B2
BIO_up_ref.LIBCRYPTO-3 ref: 00007FF8A81D41BE
BIO_s_socket.LIBCRYPTO-3 ref: 00007FF8A81D41C5
BIO_new.LIBCRYPTO-3 ref: 00007FF8A81D41CD
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81D41DA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81D41F2
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81D4202
BIO_int_ctrl.LIBCRYPTO-3 ref: 00007FF8A81D4226

Strings

SSL_set_wfd, xrefs: 00007FF8A81D41DF
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81D41EB

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_ctrlO_int_ctrlO_method_typeO_newO_s_socketO_up_refR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_set_wfd
API String ID: 475579866-2547745303
Opcode ID: d85e65c040ba6476efc46dcf5400153df1fbacbc7d13768b7dfbe919c78e6dd2
Instruction ID: ed17fe9f4da86ff1a94c910bd79936a9714385854fc68343f3c0eabb27d30b2c
Opcode Fuzzy Hash: d85e65c040ba6476efc46dcf5400153df1fbacbc7d13768b7dfbe919c78e6dd2
Instruction Fuzzy Hash: 3311D222F1E642A2FB55EB25E8426BA5240EFD47C0F481531ED1D07B9AEF2CE4408B68

Function 00007FF8A81CEAF7 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CEB02
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CEB1A
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CEB2B
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CEB49
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CEB61
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CEB72
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CEB87
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CEB9F
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CEBB0

Strings

SSL_check_private_key, xrefs: 00007FF8A81CEB07, 00007FF8A81CEB4E, 00007FF8A81CEB4F, 00007FF8A81CEB8C
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CEB13, 00007FF8A81CEB5A, 00007FF8A81CEB98

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_check_private_key
API String ID: 1552677711-2796319112
Opcode ID: 3538371cedf08bb77b1a74baf91e0bea9ccaffdb6a36c88db20adb1209e384a5
Instruction ID: 10add10d929e0a583fdf620fac47f660b146131df45239a2750e9dbc838ac503
Opcode Fuzzy Hash: 3538371cedf08bb77b1a74baf91e0bea9ccaffdb6a36c88db20adb1209e384a5
Instruction Fuzzy Hash: A521C365A2E603B2FB50E731C852AF92251EF903C4FE00132D51D026EAEF2CE546C739

Function 00007FF8B9F63334 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 309COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF8B9F63390

Part of subcall function 00007FF8B9F65768: __GetUnwindTryBlock.LIBCMT ref: 00007FF8B9F657AB
Part of subcall function 00007FF8B9F65768: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF8B9F657D0

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8B9F63468
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F63475
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF8B9F636B9
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F636E7

Part of subcall function 00007FF8B9F66E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8B9F629EE), ref: 00007FF8B9F66E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F637AD
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B9F637E2

Strings

csm, xrefs: 00007FF8B9F6348D
csm, xrefs: 00007FF8B9F633AA
csm, xrefs: 00007FF8B9F63411

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 4223619315-393685449
Opcode ID: dcb3548c504605ccad87c1df068e82445ce8bfed626f824eb2c4e809fdb80efd
Instruction ID: 799c6e16e3c5ca2d08a1f69975364a9596d84f8b051d31dd5d8d29d75cbdba2f
Opcode Fuzzy Hash: dcb3548c504605ccad87c1df068e82445ce8bfed626f824eb2c4e809fdb80efd
Instruction Fuzzy Hash: 38D18172A08B828AEB609F69D4402AD7BA0FB56BE9F101135EF8D57B55DF78E490C700

Function 00007FF8B9F6ED94 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00007FF8B9F6EDEE

Strings

generic-type-, xrefs: 00007FF8B9F6EE97
`generic-type-, xrefs: 00007FF8B9F6EECA
`template-parameter-, xrefs: 00007FF8B9F6EE83
template-parameter-, xrefs: 00007FF8B9F6EE50

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Replicator::operator[]
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3207858774
Opcode ID: 73310b6c18e80224c33410df5d9c8b136be81ee7f088e8962b8740eac16092a6
Instruction ID: 1b89cc36ffcbe64e366948a2bc23df8d9c9c9a1daa0ad66cd5e65ea4ebf6b442
Opcode Fuzzy Hash: 73310b6c18e80224c33410df5d9c8b136be81ee7f088e8962b8740eac16092a6
Instruction Fuzzy Hash: 7B918E22B18BC699FB118F2CD4902B83BA2AB547EAF856132EB4D07795DF3CE515C350

Function 00007FF8A81BB930 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81BB962
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81BB97A
BIO_write.LIBCRYPTO-3 ref: 00007FF8A81BB9A8
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81BB9B9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81BB9D1
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FF8A81BB9F8
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81BBA01
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81BBA19

Strings

..\s\ssl\s3_enc.c, xrefs: 00007FF8A81BB973, 00007FF8A81BB9CA, 00007FF8A81BBA12
ssl3_finish_mac, xrefs: 00007FF8A81BB967, 00007FF8A81BB9BE, 00007FF8A81BBA06

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$DigestO_writeUpdate
String ID: ..\s\ssl\s3_enc.c$ssl3_finish_mac
API String ID: 756221159-923099695
Opcode ID: a95665bcd28634358247280886fd913cb70f0aef32b7187c71788c1eaa285f1f
Instruction ID: b02a2be5039190f98a1a33f69ad2906fb540a650528820dc5fe079ff5e693a19
Opcode Fuzzy Hash: a95665bcd28634358247280886fd913cb70f0aef32b7187c71788c1eaa285f1f
Instruction Fuzzy Hash: 32218361F1E24276FB90E761F996BF91254EF847C0F840131ED6C82A9AEF2CE550C318

Function 00007FF8A81D79C0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

BIO_f_buffer.LIBCRYPTO-3 ref: 00007FF8A81D79E9
BIO_new.LIBCRYPTO-3 ref: 00007FF8A81D79F1
BIO_int_ctrl.LIBCRYPTO-3 ref: 00007FF8A81D7A0C
BIO_push.LIBCRYPTO-3 ref: 00007FF8A81D7A20

Strings

ssl_init_wbio_buffer, xrefs: 00007FF8A81D7A46
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81D7A52

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_f_bufferO_int_ctrlO_newO_push
String ID: ..\s\ssl\ssl_lib.c$ssl_init_wbio_buffer
API String ID: 1655923927-1860519770
Opcode ID: 07ef0fb7d60d19cdaccef97091bbc29893d822b5b0c197d7fe457630323bdb58
Instruction ID: c7992d00d631234d7775c1e540c2f3ea8eb1edc0d4d096d6fbb41b5579752604
Opcode Fuzzy Hash: 07ef0fb7d60d19cdaccef97091bbc29893d822b5b0c197d7fe457630323bdb58
Instruction Fuzzy Hash: A1119162F1A64262F794EB61F9427F92290EF943C0F841131EA1D47B9AFF2CE590C764

Function 00007FF8B8F71190 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B8F711B8
__scrt_initialize_crt.LIBCMT ref: 00007FF8B8F711FD
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B8F7120A
_RTC_Initialize.LIBCMT ref: 00007FF8B8F71238
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B8F7125E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B8F71289

Memory Dump Source

Source File: 00000002.00000002.3309270963.00007FF8B8F71000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000002.00000002.3309240746.00007FF8B8F70000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309322062.00007FF8B8F73000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309340812.00007FF8B8F75000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309359337.00007FF8B8F76000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8f70000_0jNz7djbpp.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: eb90ca1ee577f0b59d2d87c7a67cf798978c29ba68fe58bea907e0dc7a2201bc
Instruction ID: fa0e97e328417ecdd4c0b51d6a633ccd71fa420052867b53ed930e7e4f867e8e
Opcode Fuzzy Hash: eb90ca1ee577f0b59d2d87c7a67cf798978c29ba68fe58bea907e0dc7a2201bc
Instruction Fuzzy Hash: D681AF38E08E4386F7A09F6D94412B92EA1AF457C2F544135DB4D87796DF3CE49B8318

Function 00007FF8B9F69164 Relevance: 16.7, APIs: 11, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F691CC
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F692C9
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F69322
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6934E
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F69360
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6938F

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 3cac31fbce2037cca8b65a6457a1f6e1f72e09754060cc87a73fdfbcf94b07ef
Instruction ID: 10ab3fa58f898b6b3dbcd2e581f8d1ac412ffa64b7d98d00a8743de04e4e195f
Opcode Fuzzy Hash: 3cac31fbce2037cca8b65a6457a1f6e1f72e09754060cc87a73fdfbcf94b07ef
Instruction Fuzzy Hash: 52714872B08B8699EB10DF68D4901EC33B1EB4479DB806436DB0D57B9AEE38D659C390

Function 00007FF8A81B1956 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8A821F68C
ERR_new.LIBCRYPTO-3 ref: 00007FF8A821F69D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A821F6B5
EVP_MD_CTX_copy_ex.LIBCRYPTO-3 ref: 00007FF8A821F6E1
ERR_new.LIBCRYPTO-3 ref: 00007FF8A821F6EA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A821F702
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8A821F723

Strings

tls13_save_handshake_digest_for_pha, xrefs: 00007FF8A821F6A2, 00007FF8A821F6EF
..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8A821F6AE, 00007FF8A821F6FB

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$X_copy_exX_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c$tls13_save_handshake_digest_for_pha
API String ID: 401794203-262298153
Opcode ID: 24e92c9d1fa788a2a7cd987a161bfd58b78f247f229c5a50568caab08e5465c4
Instruction ID: 3fa2e647c219b575257033c74d51c243997e237a5aae7d82defacdd7e75f8a8e
Opcode Fuzzy Hash: 24e92c9d1fa788a2a7cd987a161bfd58b78f247f229c5a50568caab08e5465c4
Instruction Fuzzy Hash: 4E117C71E1B682B1FB51EB65D816BF82250EF847C4F480031DE1C466DAFF3CA5818278

Function 00007FF8A81B1960 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-3 ref: 00007FF8A81E101E
BIO_new.LIBCRYPTO-3 ref: 00007FF8A81E1026
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81E1033
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81E1049
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81E1059
BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8A81E107D
BIO_free.LIBCRYPTO-3 ref: 00007FF8A81E1092

Strings

..\s\ssl\ssl_txt.c, xrefs: 00007FF8A81E1042
SSL_SESSION_print_fp, xrefs: 00007FF8A81E1038

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_fileR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_txt.c$SSL_SESSION_print_fp
API String ID: 1031916422-1029007293
Opcode ID: 106a9bd55cb2b8fb8e07b790415dcdd5f0f90def6dcc75b4bb8a8cafdc8ce664
Instruction ID: 02799a1ac8295387cecddc116bf39fb6c76cc842077b89720bbe3352fdfefd60
Opcode Fuzzy Hash: 106a9bd55cb2b8fb8e07b790415dcdd5f0f90def6dcc75b4bb8a8cafdc8ce664
Instruction Fuzzy Hash: F001E521B2E64262E740F766E9425B95351EF887C0F440031F95D43B9EEF2CE545C724

Function 00007FF8B9F637F8 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8B9F63996
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F639A3

Part of subcall function 00007FF8B9F66E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8B9F629EE), ref: 00007FF8B9F66E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F63C57
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F63CA2
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B9F63CD7

Strings

csm, xrefs: 00007FF8B9F639BF
csm, xrefs: 00007FF8B9F638DD
csm, xrefs: 00007FF8B9F6393F

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: aad8d4203d0b1849c4fce47835e3c613ec0ba3b35d99662ed70f641d37e67567
Instruction ID: b961ca046477a3ae428f48a646d8a46bc4f32263d61e09adfb67c01379c2cc6c
Opcode Fuzzy Hash: aad8d4203d0b1849c4fce47835e3c613ec0ba3b35d99662ed70f641d37e67567
Instruction Fuzzy Hash: 03E18E73908BC28AE7209F79D4802AD7BA0FB457A9F142235EB8D57796CF78E581C700

Function 00007FF8A81B19B5 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FFB3E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FFB56
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FFC8D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FFCA5
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FFCEA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FFD02

Strings

tls_construct_extensions, xrefs: 00007FF8A81FFB43, 00007FF8A81FFC92, 00007FF8A81FFCEF
..\s\ssl\statem\extensions.c, xrefs: 00007FF8A81FFB4F, 00007FF8A81FFC9E, 00007FF8A81FFCFB

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions.c$tls_construct_extensions
API String ID: 193678381-3223585116
Opcode ID: 08c787ae1785d2847f6281a6e49616cb10735eef7c1c654edfaa429469bbfcdf
Instruction ID: 045a91797fe523b8b732dde5b12237911ad36f7dccc0fe1ba42905cf498915b4
Opcode Fuzzy Hash: 08c787ae1785d2847f6281a6e49616cb10735eef7c1c654edfaa429469bbfcdf
Instruction Fuzzy Hash: 5451F522A0D68266F761DB26E804BB92294FF847C4F444032DE8D437D9DFBCE945C768

Function 00007FF8A81B1BAE Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8A81EFE9F
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8A81EFF1F
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FF8A81EFF3A
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FF8A81EFF57
EVP_DigestInit_ex.LIBCRYPTO-3 ref: 00007FF8A81EFF6D
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FF8A81EFF87
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8A81F0043

Strings

exporter, xrefs: 00007FF8A81EFFEB

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: Digest$Final_exInit_ex$UpdateX_freeX_new
String ID: exporter
API String ID: 3991325671-111224270
Opcode ID: c449bca63d821f0470d4603290d40571543344f1adfc599f327d5d276f3cdc0f
Instruction ID: cdcb088bb453b196c8d0d5ad968332ff39e00b2d8c297c98c00099b723500c73
Opcode Fuzzy Hash: c449bca63d821f0470d4603290d40571543344f1adfc599f327d5d276f3cdc0f
Instruction Fuzzy Hash: E1517232A0A78256EB629B11E9507FA6394FF89BC4F400132EE8D47749EF7CE944C754

Function 00007FF8B9F6C7F8 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6C9AC

Part of subcall function 00007FF8B9F694B8: DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F69A29
Part of subcall function 00007FF8B9F694B8: DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F69A5E

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6C95E

Strings

std::nullptr_t, xrefs: 00007FF8B9F6C8D7
cli::array<, xrefs: 00007FF8B9F6C92B
void, xrefs: 00007FF8B9F6C842
cli::pin_ptr<, xrefs: 00007FF8B9F6C975
void , xrefs: 00007FF8B9F6C86A
std::nullptr_t , xrefs: 00007FF8B9F6C8EA

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: 0e84257edd8271f32b759845b73cd3eefe07970f5e22a962a9d02e38f5861642
Instruction ID: 554ada808f17a41db1697e577b7f4e96fb850b2afce1a5c5409a0978bb931aa6
Opcode Fuzzy Hash: 0e84257edd8271f32b759845b73cd3eefe07970f5e22a962a9d02e38f5861642
Instruction Fuzzy Hash: 6D514E62E18B959CFB118F68E8402BD7BB0BB0A7AAF445136DB8D12B95DF3C9154C710

Function 00007FF8A81ECBEE Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FF8A81ECC1A
BIO_printf.LIBCRYPTO-3 ref: 00007FF8A81ECC4E
BIO_indent.LIBCRYPTO-3 ref: 00007FF8A81ECCEA
BIO_printf.LIBCRYPTO-3 ref: 00007FF8A81ECD20

Strings

UNKNOWN, xrefs: 00007FF8A81ECD06
,, xrefs: 00007FF8A81ECC32
key_exchange: , xrefs: 00007FF8A81ECD2D
NamedGroup: %s (%d), xrefs: 00007FF8A81ECC41, 00007FF8A81ECD16

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_indentO_printf
String ID: ,$NamedGroup: %s (%d)$UNKNOWN$key_exchange:
API String ID: 1860387303-2250237447
Opcode ID: a7e4a581b3082178f443201ce1f4ff9de1b91a4622e204e9bc047db4b18d94d1
Instruction ID: 947ac4ce933596e406c2e80c722707b22f0f1918f7d8a3c082e2730dbf992b62
Opcode Fuzzy Hash: a7e4a581b3082178f443201ce1f4ff9de1b91a4622e204e9bc047db4b18d94d1
Instruction Fuzzy Hash: 89410222A1E6E2A6EA22CB19D8041B92F91EB41FC0F094433DD5D17395EF3DE542C728

Function 00007FF8A821AB20 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBCRYPTO-3 ref: 00007FF8A821AB90
ERR_new.LIBCRYPTO-3 ref: 00007FF8A821AB9A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A821ABB2
ERR_new.LIBCRYPTO-3 ref: 00007FF8A821AC25
ERR_new.LIBCRYPTO-3 ref: 00007FF8A821AC31
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A821AC49

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FF8A821ABAB, 00007FF8A821AC42
dtls1_preprocess_fragment, xrefs: 00007FF8A821AB9F, 00007FF8A821AC3B

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_new$R_set_debug$M_grow_clean
String ID: ..\s\ssl\statem\statem_dtls.c$dtls1_preprocess_fragment
API String ID: 3867660093-2459173683
Opcode ID: bcad1f618a939515b9b17526c2b9d3bd63af1911f2b4686603d2ad312544bc0b
Instruction ID: b1c52b8d7e637814b663e36ead7d48692209d90d831380d0b8b9088bf57777ff
Opcode Fuzzy Hash: bcad1f618a939515b9b17526c2b9d3bd63af1911f2b4686603d2ad312544bc0b
Instruction Fuzzy Hash: 64316F72B0AB81A5E7909B15E4413FD6760EB98BC4F544032DE4D477AADF3CD482C728

Function 00007FF8A81B1947 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81B8CAD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81B8CC5
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81B8CD6
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81B8CEB
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81B8D03
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81B8D14

Strings

..\s\ssl\d1_msg.c, xrefs: 00007FF8A81B8CBE, 00007FF8A81B8CFC
dtls1_write_app_data_bytes, xrefs: 00007FF8A81B8CB2, 00007FF8A81B8CF0

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\d1_msg.c$dtls1_write_app_data_bytes
API String ID: 1552677711-1870589286
Opcode ID: d7058bece10e3601f4c0f81150a421c5e6d30c6262cad76699e9cbfd2afccac0
Instruction ID: c9cc3244a4ffe4dde72a8c66eec5e9ecdc5c8e985b4abfbdef86725978ba7af6
Opcode Fuzzy Hash: d7058bece10e3601f4c0f81150a421c5e6d30c6262cad76699e9cbfd2afccac0
Instruction Fuzzy Hash: 1221B361F0E68665F351EB21E8157F96218FF95BD4F600131E95C03BDADF2CE810C268

Function 00007FF8A81B1C2B Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F1125
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F113D
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81F114E
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F116D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F1185
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81F1196

Strings

..\s\ssl\tls_depr.c, xrefs: 00007FF8A81F1136, 00007FF8A81F117E
SSL_CTX_set_client_cert_engine, xrefs: 00007FF8A81F112A, 00007FF8A81F1172

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\tls_depr.c$SSL_CTX_set_client_cert_engine
API String ID: 1552677711-2801407537
Opcode ID: dd8926da48fe554bf7bef03d4ee45b681770d80b6e123e6bbc4578b5fef0e44d
Instruction ID: 3520ddd519d8fdde20ba901765b1deb4b6a5485492c5ab5b4d910a4fa7239297
Opcode Fuzzy Hash: dd8926da48fe554bf7bef03d4ee45b681770d80b6e123e6bbc4578b5fef0e44d
Instruction Fuzzy Hash: CC115E61F1E24262F785E735E9426F91251EF883C0F945031E92D42BDBEF2CE9948628

Function 00007FF8A81BDC42 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81BDC47
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81BDC5F

Part of subcall function 00007FF8A81B20C2: EVP_PKEY_get_security_bits.LIBCRYPTO-3 ref: 00007FF8A81CD97C
Part of subcall function 00007FF8A81B20C2: ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CD99D
Part of subcall function 00007FF8A81B20C2: ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CD9B5
Part of subcall function 00007FF8A81B20C2: ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CD9C6

ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81BDC70
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81BDC92
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81BDCAA
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FF8A81BDCCC

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FF8A81BDC58, 00007FF8A81BDCA3
ssl3_ctx_ctrl, xrefs: 00007FF8A81BDC4C, 00007FF8A81BDC9C

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$R_set_error$Y_freeY_get_security_bits
String ID: ..\s\ssl\s3_lib.c$ssl3_ctx_ctrl
API String ID: 3247900180-780421027
Opcode ID: 3080496033423c14b35dd283f7f5fa62782183a524f3f840e6e276bcf112f778
Instruction ID: 2ddbdea8e7194d98e5423bc23280d2a507f949ba5a848dbc44041689d293a3be
Opcode Fuzzy Hash: 3080496033423c14b35dd283f7f5fa62782183a524f3f840e6e276bcf112f778
Instruction Fuzzy Hash: 8801D251F1F002A5FB85E325EA566F91241DF823C0F840431E81D47ADBEF2CE885C328

Function 00007FF8A81B5A7A Relevance: 13.6, APIs: 9, Instructions: 55COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3 ref: 00007FF8A81B5A82
BIO_set_retry_reason.LIBCRYPTO-3 ref: 00007FF8A81B5A8C
BIO_set_flags.LIBCRYPTO-3 ref: 00007FF8A81B5AC3
BIO_get_retry_reason.LIBCRYPTO-3 ref: 00007FF8A81B5ACB
BIO_set_retry_reason.LIBCRYPTO-3 ref: 00007FF8A81B5AD5
BIO_set_flags.LIBCRYPTO-3 ref: 00007FF8A81B5AE7
BIO_set_retry_reason.LIBCRYPTO-3 ref: 00007FF8A81B5AF4
BIO_set_flags.LIBCRYPTO-3 ref: 00007FF8A81B5B03
BIO_set_flags.LIBCRYPTO-3 ref: 00007FF8A81B5B12

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_set_flags$O_set_retry_reason$O_clear_flagsO_get_retry_reason
String ID:
API String ID: 3610643084-0
Opcode ID: ec346a3ecd8ef0eff09505d24858cdc67e1ff2564afee1b3c38daf08c4ed52da
Instruction ID: d86399ee2fd9561ab6ef2ebe7efa6fa9e138687057700c4ff34256932554b692
Opcode Fuzzy Hash: ec346a3ecd8ef0eff09505d24858cdc67e1ff2564afee1b3c38daf08c4ed52da
Instruction Fuzzy Hash: 84115A11F0E10366F616FB66951A2BD0246DFC5BD4F144132D82A4BB8AEF2CE543862D

Function 00007FF8B9F6662A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F66B10: RtlPcToFileHeader.KERNEL32 ref: 00007FF8B9F66B60
Part of subcall function 00007FF8B9F66B10: RaiseException.KERNEL32 ref: 00007FF8B9F66BA1

RtlPcToFileHeader.KERNEL32 ref: 00007FF8B9F666C7
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FF8B9F66723

Strings

Attempted a typeid of nullptr pointer!, xrefs: 00007FF8B9F66805
Access violation - no RTTI data!, xrefs: 00007FF8B9F6662A, 00007FF8B9F6684B
Bad read pointer - no RTTI data!, xrefs: 00007FF8B9F66828
Bad dynamic_cast!, xrefs: 00007FF8B9F66792

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1852475696-928371585
Opcode ID: 4ef8ad2c729168d00ef0645f383a1968f42c4eb1f6a8b3717fe5ffb80b324514
Instruction ID: d8953647ee1a8d580baae80af237be340968764f70d13ee7b245b1209724c1e1
Opcode Fuzzy Hash: 4ef8ad2c729168d00ef0645f383a1968f42c4eb1f6a8b3717fe5ffb80b324514
Instruction Fuzzy Hash: 28519D62B18B86A2EE20CFA8E8911B96760FF85BEAF405531DB4D47759EF7CE505C300

Function 00007FF8B9F66FE4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF8B9F671A3,?,?,00000000,00007FF8B9F66FD4,?,?,?,?,00007FF8B9F66D11), ref: 00007FF8B9F67069
GetLastError.KERNEL32(?,?,?,00007FF8B9F671A3,?,?,00000000,00007FF8B9F66FD4,?,?,?,?,00007FF8B9F66D11), ref: 00007FF8B9F67077
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B9F671A3,?,?,00000000,00007FF8B9F66FD4,?,?,?,?,00007FF8B9F66D11), ref: 00007FF8B9F67090
LoadLibraryExW.KERNEL32(?,?,?,00007FF8B9F671A3,?,?,00000000,00007FF8B9F66FD4,?,?,?,?,00007FF8B9F66D11), ref: 00007FF8B9F670A2
FreeLibrary.KERNEL32(?,?,?,00007FF8B9F671A3,?,?,00000000,00007FF8B9F66FD4,?,?,?,?,00007FF8B9F66D11), ref: 00007FF8B9F67110
GetProcAddress.KERNEL32(?,?,?,00007FF8B9F671A3,?,?,00000000,00007FF8B9F66FD4,?,?,?,?,00007FF8B9F66D11), ref: 00007FF8B9F6711C

Strings

api-ms-, xrefs: 00007FF8B9F67089

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 76e9ed00015fa7378e2762435fe1c6674923b12dca3248f544122840abba5d3b
Instruction ID: 7738415722352f197933ac7d2e92e6b3581a3ec6d69ec7219ca748cf8621009c
Opcode Fuzzy Hash: 76e9ed00015fa7378e2762435fe1c6674923b12dca3248f544122840abba5d3b
Instruction Fuzzy Hash: E1316D21B1ABC2A2EE119F0AE8005B56794BF04BF6F195535DE1E0B7A8EF7CE544C310

Function 00007FF8A81F9980 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F99CA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F99E2
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F9A2F
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F9A47
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F9A89

Strings

..\s\ssl\record\ssl3_record.c, xrefs: 00007FF8A81F99DB, 00007FF8A81F9A40
early_data_count_ok, xrefs: 00007FF8A81F99CF, 00007FF8A81F9A39

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ..\s\ssl\record\ssl3_record.c$early_data_count_ok
API String ID: 476316267-4150192623
Opcode ID: 57024454248ba0eee51447f81ee26c85974a6700e108d1ac7d5cc71fd0c652fd
Instruction ID: 7877868e6420234a3ad4782b9324ad7a7dff3f94f24a74aeb74da0c217e799da
Opcode Fuzzy Hash: 57024454248ba0eee51447f81ee26c85974a6700e108d1ac7d5cc71fd0c652fd
Instruction Fuzzy Hash: FC31E232B0A542A7FB55EB24E4457FD2390EB847C4F554032EA0E4B699EF3CE985C728

Function 00007FF8A81B1B22 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A820FA5E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A820FA76
memcpy.VCRUNTIME140 ref: 00007FF8A820FA95
ERR_new.LIBCRYPTO-3 ref: 00007FF8A820FAB8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A820FAD0

Strings

dtls_process_hello_verify, xrefs: 00007FF8A820FA63, 00007FF8A820FABD
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A820FA6F, 00007FF8A820FAC9

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$memcpy
String ID: ..\s\ssl\statem\statem_clnt.c$dtls_process_hello_verify
API String ID: 31086664-1847652839
Opcode ID: 2c88d434c8cf1806e8fd1677df89b65b16c9a3f0bfbfd464e2d8ae8238af89f1
Instruction ID: 314eb0e01e2374f878c062ae612f87453fb6766dda68ab03e4fef34082c55e03
Opcode Fuzzy Hash: 2c88d434c8cf1806e8fd1677df89b65b16c9a3f0bfbfd464e2d8ae8238af89f1
Instruction Fuzzy Hash: 5821B4A2F1DA8561E720DB24E9012B96360FF897D0F848231EA9C437DAEF3CE591C714

Function 00007FF8A8210BF3 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8210C5B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8210C73
memcpy.VCRUNTIME140 ref: 00007FF8A8210C92
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8210CBC
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8210CD4

Strings

dtls_process_hello_verify, xrefs: 00007FF8A8210C60, 00007FF8A8210CC1
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A8210C6C, 00007FF8A8210CCD

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug$memcpy
String ID: ..\s\ssl\statem\statem_clnt.c$dtls_process_hello_verify
API String ID: 31086664-1847652839
Opcode ID: 1fe6c31ecea433c8facf989d7f46b2bc88c07b2a138a6b116675d1ff8645ff0d
Instruction ID: 940cadc808a7fb76b6185ea6e260015e06036e43577113134c1ea6c57c0ccf46
Opcode Fuzzy Hash: 1fe6c31ecea433c8facf989d7f46b2bc88c07b2a138a6b116675d1ff8645ff0d
Instruction Fuzzy Hash: D521D3B2F19B8551E7109B25E8412B9A351EF94BD0F449232EE9D037EEEF3CE4808714

Function 00007FF8A81DBC40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(00000000,00007FF8A81DA8D8), ref: 00007FF8A81DBC6B
ERR_set_debug.LIBCRYPTO-3(00000000,00007FF8A81DA8D8), ref: 00007FF8A81DBC83
ERR_set_error.LIBCRYPTO-3(00000000,00007FF8A81DA8D8), ref: 00007FF8A81DBC94
EVP_PKEY_free.LIBCRYPTO-3(00000000,00007FF8A81DA8D8), ref: 00007FF8A81DBCD3
EVP_PKEY_up_ref.LIBCRYPTO-3(00000000,00007FF8A81DA8D8), ref: 00007FF8A81DBCDB

Strings

ssl_set_pkey, xrefs: 00007FF8A81DBC70
..\s\ssl\ssl_rsa.c, xrefs: 00007FF8A81DBC7C

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorY_freeY_up_ref
String ID: ..\s\ssl\ssl_rsa.c$ssl_set_pkey
API String ID: 4194652714-507513155
Opcode ID: 39f4fb155c2929f564d4ecb20fc359980c90a3723bdfcedffaf70fc587f1c144
Instruction ID: e326ab5fa8ecce8c3860239dc59377dfcf79b481e511509f453346eeedf896a7
Opcode Fuzzy Hash: 39f4fb155c2929f564d4ecb20fc359980c90a3723bdfcedffaf70fc587f1c144
Instruction Fuzzy Hash: AA21DF62B19A42A2EF40DB15E8812BD6360FB89BC0F944132EB4D4379AEF3CD561C724

Function 00007FF8A81D3A57 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

BIO_s_socket.LIBCRYPTO-3 ref: 00007FF8A81D3A8D
BIO_new.LIBCRYPTO-3 ref: 00007FF8A81D3A95
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81D3AA2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81D3ABA
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81D3ACA
BIO_int_ctrl.LIBCRYPTO-3 ref: 00007FF8A81D3AEE
BIO_next.LIBCRYPTO-3 ref: 00007FF8A81D3B02
BIO_up_ref.LIBCRYPTO-3 ref: 00007FF8A81D3B15
BIO_next.LIBCRYPTO-3 ref: 00007FF8A81D3B29
BIO_next.LIBCRYPTO-3 ref: 00007FF8A81D3B42
BIO_free_all.LIBCRYPTO-3 ref: 00007FF8A81D3B56

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81D3AB3
SSL_set_fd, xrefs: 00007FF8A81D3AA7

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_next$O_free_allO_int_ctrlO_newO_s_socketO_up_refR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_set_fd
API String ID: 2935861444-3152457077
Opcode ID: 17fc1f9a6157696bf755d150d7f584e62e799007193cca9c2486c6096195e493
Instruction ID: e6c17ed11a6646fd96f8fd7610154f9ce1894db127e4c73d9901ffec7d7276d1
Opcode Fuzzy Hash: 17fc1f9a6157696bf755d150d7f584e62e799007193cca9c2486c6096195e493
Instruction Fuzzy Hash: DFF0C222F1E64272E740E725E8062F65290EF883C0F840031E91C43B9BFF2CE541CB64

Function 00007FF8B8F710B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

PyErr_NewExceptionWithDoc.PYTHON312 ref: 00007FF8B8F710D5
PyModule_AddObjectRef.PYTHON312 ref: 00007FF8B8F710F1
PyType_FromModuleAndSpec.PYTHON312 ref: 00007FF8B8F71108
PyModule_AddType.PYTHON312 ref: 00007FF8B8F7111C

Strings

Empty, xrefs: 00007FF8B8F710E7
_queue.Empty, xrefs: 00007FF8B8F710CB
Exception raised by Queue.get(block=0)/get_nowait()., xrefs: 00007FF8B8F710BE

Memory Dump Source

Source File: 00000002.00000002.3309270963.00007FF8B8F71000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000002.00000002.3309240746.00007FF8B8F70000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309322062.00007FF8B8F73000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309340812.00007FF8B8F75000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309359337.00007FF8B8F76000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8f70000_0jNz7djbpp.jbxd

Similarity

API ID: Module_$Err_ExceptionFromModuleObjectSpecTypeType_With
String ID: Empty$Exception raised by Queue.get(block=0)/get_nowait().$_queue.Empty
API String ID: 1138974572-1946099957
Opcode ID: f121cb2eee6e80a942454bf0bf1bd0c36165a64d1fffbf990f1473ac1b9fb972
Instruction ID: 881cfaf29c88e732efa69389a25fc312a8e6fed31d0cc4b95e765aa5d322e446
Opcode Fuzzy Hash: f121cb2eee6e80a942454bf0bf1bd0c36165a64d1fffbf990f1473ac1b9fb972
Instruction Fuzzy Hash: 3F018039B09F43A2FA048F2DE8505652764AF0ABD6F845134CB1D0AB54EF6CE05AC304

Function 00007FF8B9F62C38 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62CF0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62D0E
__AdjustPointer.LIBCMT ref: 00007FF8B9F62D4F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62D5C
__AdjustPointer.LIBCMT ref: 00007FF8B9F62D98
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62DAD
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62DF2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62DF9

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: 65b26e5f074ca0aafdff43cbb52cf6556557cf4e92b090b05be647d0b4ff5bec
Instruction ID: 79d91eb5ec410e356762861ca95cb8fa365873ef54ee14067ddf8fd7ad1836de
Opcode Fuzzy Hash: 65b26e5f074ca0aafdff43cbb52cf6556557cf4e92b090b05be647d0b4ff5bec
Instruction Fuzzy Hash: 5051AE21A0ABC282FAA59F1CD4446B867A4AF54FF6F09A435CF8D86795DF7CE442C300

Function 00007FF8B9F62E1C Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62ED6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62EF5
__AdjustPointer.LIBCMT ref: 00007FF8B9F62F36
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62F43
__AdjustPointer.LIBCMT ref: 00007FF8B9F62F7F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62F94
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62FD9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62FE0

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: d568fcbafcd5d9e8e83e95e63f5b62363508f79f2b2b670005157146ca98b55e
Instruction ID: 55eaba6fd821c135a66caabca78a54836f6fc690378a8b0e3eaffa3b62506bd7
Opcode Fuzzy Hash: d568fcbafcd5d9e8e83e95e63f5b62363508f79f2b2b670005157146ca98b55e
Instruction Fuzzy Hash: 4A51B021F1ABC281EA65CF1CD4446B86794AF54FE2F09A535DB8D86795DF7CE441C300

Function 00007FF8B9F6EB88 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6EBFC
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6EC0B

Part of subcall function 00007FF8B9F6CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6CE4D
Part of subcall function 00007FF8B9F6CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6CE86
Part of subcall function 00007FF8B9F6CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6D1B1

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6ECAB
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6ECBB
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6ED67

Strings

{for , xrefs: 00007FF8B9F6EC34

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: ad201dfe96a96ae0dc6555201844fc758e8e36effd4b63a30410ed7392a88b68
Instruction ID: 156b843c957b465687e8b06f5f0ccddb842320eefe4356c87573b372f72d8019
Opcode Fuzzy Hash: ad201dfe96a96ae0dc6555201844fc758e8e36effd4b63a30410ed7392a88b68
Instruction Fuzzy Hash: C7513D72A08BC5ADEB019F28D4403E83BA1EB45799F849031EB4C4BBA9DF7CE565C300

Function 00007FF8B9F6E174 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF8B9F6D86D), ref: 00007FF8B9F6E238
DName::DName.LIBVCRUNTIME ref: 00007FF8B9F6E257

Strings

void, xrefs: 00007FF8B9F6E1BA
`template-parameter, xrefs: 00007FF8B9F6E265

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 1a349dcf90f4e371f1810c8875e562b3843b42aeee856190ba29246ab6ec8260
Instruction ID: f4a716e71083a1100192488dad28b8d2c7258cba9e07f61d3a081c63d48ba4e4
Opcode Fuzzy Hash: 1a349dcf90f4e371f1810c8875e562b3843b42aeee856190ba29246ab6ec8260
Instruction Fuzzy Hash: 56414922F08B9698FB018FA8D8512BC2BB2BB48BE9F541135DF4C26B59DF7CA545C340

Function 00007FF8A81B19C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8201FA6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8201FBE

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8A8201FB7, 00007FF8A820207B
tls_construct_ctos_ec_pt_formats, xrefs: 00007FF8A8201FAB, 00007FF8A820206F

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_clnt.c$tls_construct_ctos_ec_pt_formats
API String ID: 193678381-302162076
Opcode ID: a012173c701b202fdd5d8373fddc64a3d9e99b1ed4de02e621ddb34dfb993357
Instruction ID: ff7ec91555fa62cbd107ee730fd72790014a2c69b819766cb177dce4b63d9be4
Opcode Fuzzy Hash: a012173c701b202fdd5d8373fddc64a3d9e99b1ed4de02e621ddb34dfb993357
Instruction Fuzzy Hash: 3E31C561B0D34261F721A712E5052FA67A0EF84BC4F444031EE8C47B9EDF6CE945C764

Function 00007FF8B9F6ACC4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 79COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6ADA7

Strings

char , xrefs: 00007FF8B9F6AD4D
int , xrefs: 00007FF8B9F6AD35
short , xrefs: 00007FF8B9F6AD44
long , xrefs: 00007FF8B9F6AD26
unsigned , xrefs: 00007FF8B9F6AD7B

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: 041e2dffe1b489bc893f09ff0a4f423b3d9eca273271e83df22d622629981137
Instruction ID: f0988c0b8c84a20f3a87a0d60703ba617d91d6ca91de8b8a05b70602fb0fe491
Opcode Fuzzy Hash: 041e2dffe1b489bc893f09ff0a4f423b3d9eca273271e83df22d622629981137
Instruction Fuzzy Hash: 83313A72E18B9188EB128F6CD8941BC3BB1FB097AAF449135DB5D46B68DE3CE504C710

Function 00007FF8A820FC10 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-3 ref: 00007FF8A820FC66
EVP_DigestInit.LIBCRYPTO-3 ref: 00007FF8A820FC79
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FF8A820FC92
EVP_DigestUpdate.LIBCRYPTO-3 ref: 00007FF8A820FCAB
EVP_DigestFinal_ex.LIBCRYPTO-3 ref: 00007FF8A820FCBF
EVP_MD_CTX_free.LIBCRYPTO-3 ref: 00007FF8A820FCCB

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: Digest$Update$Final_exInitX_freeX_new
String ID:
API String ID: 3927069315-0
Opcode ID: 3583035346c7cd232aab5c19eb5d55da73f0edce0933137d407b6799218f8909
Instruction ID: 6af58ea5d1e2ed04fa4c1d8849ac671851037efd5260827926faebec6e529495
Opcode Fuzzy Hash: 3583035346c7cd232aab5c19eb5d55da73f0edce0933137d407b6799218f8909
Instruction Fuzzy Hash: 9A219261B0A74255EA50E716A9522BE5260EF85BC0F480035FE4E477DFEF3CE8418718

Function 00007FF8A81B1C67 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A821DCD0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A821DCE8
ERR_new.LIBCRYPTO-3 ref: 00007FF8A821DD32
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A821DD4A

Strings

ssl3_output_cert_chain, xrefs: 00007FF8A821DCD5, 00007FF8A821DD37
..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8A821DCE1, 00007FF8A821DD43

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$ssl3_output_cert_chain
API String ID: 193678381-603691555
Opcode ID: f081b8c109e92a1b4520bf5d4836e297576145d0270ff87205bc6287f4a9dde4
Instruction ID: 3016537e5852e7e5643779a3cb52277e6f98c2b3321b9b72b88fa099197d2847
Opcode Fuzzy Hash: f081b8c109e92a1b4520bf5d4836e297576145d0270ff87205bc6287f4a9dde4
Instruction Fuzzy Hash: 3F214F31F1E182A1E790D726E9456B95654EFC87C0F844031EE4D87B9EEF2CE541C768

Function 00007FF8A81D7C10 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3(?,?,?,?,?,?,00007FF8A81D2A37), ref: 00007FF8A81D7C40
ERR_set_debug.LIBCRYPTO-3(?,?,?,?,?,?,00007FF8A81D2A37), ref: 00007FF8A81D7C58
ERR_set_error.LIBCRYPTO-3(?,?,?,?,?,?,00007FF8A81D2A37), ref: 00007FF8A81D7C69

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81D7C51
ssl_peek_internal, xrefs: 00007FF8A81D7C45

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_peek_internal
API String ID: 1552677711-1363730714
Opcode ID: 3bca421143e6903208f4b76cd5e3fc67da27b4d2d9bbfcdf774d270b5de6ef08
Instruction ID: ce6ed4d664ec35ed9d2d621bb246cc3d84f2528ceec54ee04f9196cf70bf6365
Opcode Fuzzy Hash: 3bca421143e6903208f4b76cd5e3fc67da27b4d2d9bbfcdf774d270b5de6ef08
Instruction Fuzzy Hash: 0821B232A0A782A5E711DB15E4413AA73A0FB84BC4F580535EE9D03BA9DF3CD142CB64

Function 00007FF8A81FD9F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FDA23
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FDA3B
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FDA78
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FDA90

Strings

final_renegotiate, xrefs: 00007FF8A81FDA28, 00007FF8A81FDA7D
..\s\ssl\statem\extensions.c, xrefs: 00007FF8A81FDA34, 00007FF8A81FDA89

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions.c$final_renegotiate
API String ID: 193678381-1135624566
Opcode ID: 1a7262c2a771920ea0613e27e9eb0b7673a5ec7af0afdd2d19e460d6755fe7da
Instruction ID: e142af664173ac216d5978949b15ba7351984aefcffd6262399aa3fb09eb5e62
Opcode Fuzzy Hash: 1a7262c2a771920ea0613e27e9eb0b7673a5ec7af0afdd2d19e460d6755fe7da
Instruction Fuzzy Hash: D6119162F1A142AAFB52D764D84ABF42250EF84790F844832D91D066D6EF6CA9C2C738

Function 00007FF8A81B1A5A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81D95F3
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81D960B
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81D961B
EVP_PKEY_free.LIBCRYPTO-3 ref: 00007FF8A81D9641

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8A81D9604
SSL_CTX_use_PrivateKey_ASN1, xrefs: 00007FF8A81D95F8

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorY_free
String ID: ..\s\ssl\ssl_rsa.c$SSL_CTX_use_PrivateKey_ASN1
API String ID: 3531505993-1502814970
Opcode ID: 3a6c7bc6665b9e7f4110a1dbfc7a7522c84964e7b4f4a0f192ab00262448a87b
Instruction ID: c2ee6aa7ae487d64a8cb0ae3ca0c5f481965e7603fda14b525edd600923fa4b0
Opcode Fuzzy Hash: 3a6c7bc6665b9e7f4110a1dbfc7a7522c84964e7b4f4a0f192ab00262448a87b
Instruction Fuzzy Hash: C7018466B0EA41A1E741EB25E5412FD63A0FF897C0F944031EA4C43B9AFF3CD554CA28

Function 00007FF8B8F726A8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON312 ref: 00007FF8B8F726C8
PyThread_allocate_lock.PYTHON312 ref: 00007FF8B8F726D2
_Py_Dealloc.PYTHON312 ref: 00007FF8B8F726F6
PyErr_SetString.PYTHON312 ref: 00007FF8B8F7270D
_Py_Dealloc.PYTHON312 ref: 00007FF8B8F7272C

Strings

can't allocate lock, xrefs: 00007FF8B8F72703

Memory Dump Source

Source File: 00000002.00000002.3309270963.00007FF8B8F71000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000002.00000002.3309240746.00007FF8B8F70000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309322062.00007FF8B8F73000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309340812.00007FF8B8F75000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309359337.00007FF8B8F76000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8f70000_0jNz7djbpp.jbxd

Similarity

API ID: Dealloc$Err_List_StringThread_allocate_lock
String ID: can't allocate lock
API String ID: 214698565-1504453919
Opcode ID: d94c3e7382fc6bdb3565522f2238be69152e9bb73497608510765ad1451ebbd6
Instruction ID: 5151008a043cfb552c2984d011a2acccfca7311f23d238869560680c59f9ffe9
Opcode Fuzzy Hash: d94c3e7382fc6bdb3565522f2238be69152e9bb73497608510765ad1451ebbd6
Instruction Fuzzy Hash: CE111839A09F4391FB544F29A94433827E1BB48B9AF441439CB4E41390EF7CA4478309

Function 00007FF8A81B1AAA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

EC_KEY_get0_group.LIBCRYPTO-3 ref: 00007FF8A81F147C
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81F1486
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81F149E
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81F14AF

Strings

ssl_set_tmp_ecdh_groups, xrefs: 00007FF8A81F148B
..\s\ssl\tls_depr.c, xrefs: 00007FF8A81F1497

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_errorY_get0_group
String ID: ..\s\ssl\tls_depr.c$ssl_set_tmp_ecdh_groups
API String ID: 2690379533-3926364423
Opcode ID: d1aefb1aaf028bbb007f9da85ebefceede372a61937f9bb57e0280b92e391996
Instruction ID: ca396075533dfbdad4cae868bdbfb9e9186aec467d205907e22ae969da8b4096
Opcode Fuzzy Hash: d1aefb1aaf028bbb007f9da85ebefceede372a61937f9bb57e0280b92e391996
Instruction Fuzzy Hash: BE01DF61F1E242A5FB41E725A9026F92251EF887C0F940031E94D43B9BEF2CD880C628

Function 00007FF8B9F6ADEC Relevance: 9.2, APIs: 6, Instructions: 161COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF8B9F6AE9E
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6AEAE
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6AECB
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6AF3E
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6AF67

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 80a690cc5bf4571957900b2ba371d1f0df44bd22a0b18b914ff66e25afa9163e
Instruction ID: 897ef44d6220ba5fbf3e2a63d9a834f3839729b1fb9dd9788de6b658ea148c3b
Opcode Fuzzy Hash: 80a690cc5bf4571957900b2ba371d1f0df44bd22a0b18b914ff66e25afa9163e
Instruction Fuzzy Hash: 92717972A18B9289E7018FADE8902BC3BA1BB507E6F519135EB0D17B99CF7CE441C340

Function 00007FF8B9F669F0 Relevance: 9.1, APIs: 6, Instructions: 83stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FF8B9F66A43
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B9F66A86
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B9F66AB0
InterlockedPushEntrySList.KERNEL32 ref: 00007FF8B9F66ACD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B9F66AD9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B9F66AE2

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: 0fa2fcead297943da074142d2fbec92c84cd60449e30d9ad217028345c3eb4d3
Instruction ID: 12991291da369dcc14f0388d540761fafb2b349a39bd02ec692c63f8ffc1f2a0
Opcode Fuzzy Hash: 0fa2fcead297943da074142d2fbec92c84cd60449e30d9ad217028345c3eb4d3
Instruction Fuzzy Hash: DA31A122B19BD191EB15DF6AE80456927A0FF4AFF1B599635DE2D03780EE3DE441C300

Function 00007FF8B9F63F60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F66E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8B9F629EE), ref: 00007FF8B9F66E56

EncodePointer.KERNEL32 ref: 00007FF8B9F63FD0
_CallSETranslator.LIBVCRUNTIME ref: 00007FF8B9F6401B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F6424E

Strings

MOC, xrefs: 00007FF8B9F63FE4
RCC, xrefs: 00007FF8B9F63FEC

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 93ffbb8a8c38b724cb13d32310db34e78531563cac4ba1370c621256939a6833
Instruction ID: b6b7d1b4f236da024bad46325152e59880d4ec174c14f2c50a53cb066fa5580a
Opcode Fuzzy Hash: 93ffbb8a8c38b724cb13d32310db34e78531563cac4ba1370c621256939a6833
Instruction Fuzzy Hash: 8A91CF73A08BD28AE711DF68E8802AD7BA0FB45799F105139EB8D17B59DF38E195C700

Function 00007FF8B9F6C540 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6C7E0

Strings

volatile , xrefs: 00007FF8B9F6C5A7, 00007FF8B9F6C6D8
std::nullptr_t, xrefs: 00007FF8B9F6C799
volatile, xrefs: 00007FF8B9F6C5B6, 00007FF8B9F6C6E7
std::nullptr_t , xrefs: 00007FF8B9F6C770

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: 01adbf8b940f63687fb8b05ad2c3f4aee868cfabe9c87335b9cb2bee01f92b8d
Instruction ID: de43c34d3dc49d95d7c251584b5e70f399cbeb73023b199eb6277328907a0de9
Opcode Fuzzy Hash: 01adbf8b940f63687fb8b05ad2c3f4aee868cfabe9c87335b9cb2bee01f92b8d
Instruction Fuzzy Hash: E9717C72A08B8288EB548F2CD9500BC7BA5BB097E6F846535DB9D57B99DF3CE160C340

Function 00007FF8B9F63CF0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F66E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8B9F629EE), ref: 00007FF8B9F66E56

EncodePointer.KERNEL32 ref: 00007FF8B9F63D4F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF8B9F63D9B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F63F57

Strings

MOC, xrefs: 00007FF8B9F63D63
RCC, xrefs: 00007FF8B9F63D6B

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 8e034f92e989b9960bc08160daca0ef1833c14a7b13808a87468da7d70181806
Instruction ID: 7a5df23cdf46efb61bd753c08f30a7aa0f7910c7482d040cac200081bbf15742
Opcode Fuzzy Hash: 8e034f92e989b9960bc08160daca0ef1833c14a7b13808a87468da7d70181806
Instruction Fuzzy Hash: EA61B232918BC582E7618F19E4403AABBA0FB95BE5F045235EB9D07B55DF7CE194CB00

Function 00007FF8B9F65C50 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 135COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF8B9F65D22

Strings

RCC, xrefs: 00007FF8B9F65C9C
csm, xrefs: 00007FF8B9F65CB2
MOC, xrefs: 00007FF8B9F65C90
csm, xrefs: 00007FF8B9F65DDF

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: FileHeader
String ID: MOC$RCC$csm$csm
API String ID: 104395404-1441736206
Opcode ID: 5815091cf7d4bf77be2b6452b49c3696097c0f3c73df3e225fc204c9d15c1510
Instruction ID: c9b22e030c1df5507a64c53a125d0fcd7afec267641f090de0eee6818202ba9b
Opcode Fuzzy Hash: 5815091cf7d4bf77be2b6452b49c3696097c0f3c73df3e225fc204c9d15c1510
Instruction Fuzzy Hash: CD51BE32A1978296EAA09F29D14017E2AA0FF557E6F142135DF8D67781DF3CF861C740

Function 00007FF8A81D49A6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81D49D2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81D4AF3
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81D4B04

Part of subcall function 00007FF8A81B1D43: BIO_ctrl.LIBCRYPTO-3 ref: 00007FF8A820EC36

Strings

SSL_write_early_data, xrefs: 00007FF8A81D4AE5
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81D4AEC

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_ctrlR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_write_early_data
API String ID: 3777157029-3084438645
Opcode ID: b64caff3e830c64fb9b79d6ba9e379cac4744efc1bdb6f067198b4ae53f652c4
Instruction ID: ce43aca0a49bb6f2b68192f4c9f5f41a87c1923f723fd9c519147fb8b01c8892
Opcode Fuzzy Hash: b64caff3e830c64fb9b79d6ba9e379cac4744efc1bdb6f067198b4ae53f652c4
Instruction Fuzzy Hash: 97318062B0A642A7F76ADB22D6813BD6790FB447D0F100036DB5D43686DF3CE461CB28

Function 00007FF8A81B1B45 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81C06F2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81C070A
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81C071A

Strings

..\s\ssl\s3_msg.c, xrefs: 00007FF8A81C0703
ssl3_do_change_cipher_spec, xrefs: 00007FF8A81C06F7

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\s3_msg.c$ssl3_do_change_cipher_spec
API String ID: 1552677711-2597545827
Opcode ID: 396dfe84239bcc4f7de47202a2e46f42dd99596e70bd6f52f4e63e825aefa645
Instruction ID: 31a993ee122a117ed31a977868dfdeb7ccda6ba058c36adf5ff6f6f6b96ff4ad
Opcode Fuzzy Hash: 396dfe84239bcc4f7de47202a2e46f42dd99596e70bd6f52f4e63e825aefa645
Instruction Fuzzy Hash: C521A262B1A64592FB44DF29E8843FD2390FB88BC4F984031DA4D87795DF38C882C758

Function 00007FF8A81B1B3B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A82153FA
ERR_new.LIBCRYPTO-3 ref: 00007FF8A8215414
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A821542C

Strings

tls_construct_next_proto, xrefs: 00007FF8A8215419
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A8215425

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugmemset
String ID: ..\s\ssl\statem\statem_clnt.c$tls_construct_next_proto
API String ID: 2489314161-3748680027
Opcode ID: a63ed33d5ae16ae017d3757c2c6a9199de8a0d40b97f66390abf19fc98b05f30
Instruction ID: 18ccd16db82bee6c71963e211d96add0bbcd43e90178be27c196e3f048ca6b70
Opcode Fuzzy Hash: a63ed33d5ae16ae017d3757c2c6a9199de8a0d40b97f66390abf19fc98b05f30
Instruction Fuzzy Hash: DD11D322B2968151E740DB52F4457FA6210FB88BC4F440031EE4D8BB8EDF2CD541C764

Function 00007FF8A81D7B20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81D7B38
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81D7B50

Strings

RSA, xrefs: 00007FF8A81D7B77
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81D7B49
ssl_log_rsa_client_key_exchange, xrefs: 00007FF8A81D7B3D

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\ssl_lib.c$RSA$ssl_log_rsa_client_key_exchange
API String ID: 193678381-1475867426
Opcode ID: f63da21c475a7f83d47ad1fdf2e90d13d45e81726cadcc5edb9713703b8c50f9
Instruction ID: 090ec467785a4858dcfdc780a3d7e55ff26021f65d8d3d5a68c227ef327c6b31
Opcode Fuzzy Hash: f63da21c475a7f83d47ad1fdf2e90d13d45e81726cadcc5edb9713703b8c50f9
Instruction Fuzzy Hash: 48F0F665F2A646A2E700E761FC056F56254EF943C0F840030DD8C4779AEF2CE290C778

Function 00007FF8A81B1A00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81D29F2
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81D2A0A
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81D2A1B

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81D2A03
SSL_peek, xrefs: 00007FF8A81D29F7

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_peek
API String ID: 1552677711-1473178562
Opcode ID: b7337fe6ce6d8c032f6f18129c067dc5f31905d5b9b69bec1520e975fd3ce44c
Instruction ID: bb30f12ce825e6dcf59c36d072b261d01fcefe9e18d6fe91819543a253d765d4
Opcode Fuzzy Hash: b7337fe6ce6d8c032f6f18129c067dc5f31905d5b9b69bec1520e975fd3ce44c
Instruction Fuzzy Hash: B6F05E65E1B15666E751E325D842AF92210EF95780FE00131E62C429E7EF2CE545CA64

Function 00007FF8A81B1B2C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81D7163
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81D717B
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81D718C

Strings

ssl_check_srvr_ecc_cert_and_alg, xrefs: 00007FF8A81D7168
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81D7174

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_check_srvr_ecc_cert_and_alg
API String ID: 1552677711-1191861246
Opcode ID: c41aa21bc8e69c49e68a36b23f3fdc6b30ceacc36a38453507638091020d385f
Instruction ID: f719e14f5c274d6b3d04dde488677437708a9be47f077e89f78700781c811219
Opcode Fuzzy Hash: c41aa21bc8e69c49e68a36b23f3fdc6b30ceacc36a38453507638091020d385f
Instruction Fuzzy Hash: C1F01559E1A19262F795A729C8463F81290EF843C4FD05170E51D42AD6EF2CA68ACB39

Function 00007FF8A81CBA10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CBA1D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CBA35
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CBA46

Strings

ssl_undefined_function, xrefs: 00007FF8A81CBA22
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CBA2E

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_undefined_function
API String ID: 1552677711-2204979087
Opcode ID: f10b79996c2a92eca45b8211c9476f5ccabb41adeda706c1bd57ea5441c51930
Instruction ID: 0091a31f0d9c3d3e4c707103096ee3fb7000c559a8dbdce6afaf1d5bbae9f8e4
Opcode Fuzzy Hash: f10b79996c2a92eca45b8211c9476f5ccabb41adeda706c1bd57ea5441c51930
Instruction Fuzzy Hash: 8FE0EC19F2A14276F340F77098575F91210EF91390FD04031E00D42A9AEF2CA589C774

Function 00007FF8A81CBA70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CBA7D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CBA95
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CBAA6

Strings

ssl_undefined_function, xrefs: 00007FF8A81CBA82
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CBA8E

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_undefined_function
API String ID: 1552677711-2204979087
Opcode ID: ad13ed55bfa56bdfb604f0a7537003d1c24469e83d093fb3ba2bee9aa2a07846
Instruction ID: 0091a31f0d9c3d3e4c707103096ee3fb7000c559a8dbdce6afaf1d5bbae9f8e4
Opcode Fuzzy Hash: ad13ed55bfa56bdfb604f0a7537003d1c24469e83d093fb3ba2bee9aa2a07846
Instruction Fuzzy Hash: 8FE0EC19F2A14276F340F77098575F91210EF91390FD04031E00D42A9AEF2CA589C774

Function 00007FF8A81CBAD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CBADD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CBAF5
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CBB06

Strings

ssl_undefined_function, xrefs: 00007FF8A81CBAE2
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CBAEE

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_undefined_function
API String ID: 1552677711-2204979087
Opcode ID: a890c7a6ce92884863d797033b923ca2f477f9b754829e71e2c510313747f760
Instruction ID: 0091a31f0d9c3d3e4c707103096ee3fb7000c559a8dbdce6afaf1d5bbae9f8e4
Opcode Fuzzy Hash: a890c7a6ce92884863d797033b923ca2f477f9b754829e71e2c510313747f760
Instruction Fuzzy Hash: 8FE0EC19F2A14276F340F77098575F91210EF91390FD04031E00D42A9AEF2CA589C774

Function 00007FF8A81CBB30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CBB3D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CBB55
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CBB66

Strings

ssl_undefined_function, xrefs: 00007FF8A81CBB42
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CBB4E

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_undefined_function
API String ID: 1552677711-2204979087
Opcode ID: 56e15a37842fe0dd599d6c964779cc2f16a4635d9b4f78df93a97c8c002367dd
Instruction ID: 0091a31f0d9c3d3e4c707103096ee3fb7000c559a8dbdce6afaf1d5bbae9f8e4
Opcode Fuzzy Hash: 56e15a37842fe0dd599d6c964779cc2f16a4635d9b4f78df93a97c8c002367dd
Instruction Fuzzy Hash: 8FE0EC19F2A14276F340F77098575F91210EF91390FD04031E00D42A9AEF2CA589C774

Function 00007FF8A81CBB90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CBB9D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CBBB5
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CBBC6

Strings

ssl_undefined_function, xrefs: 00007FF8A81CBBA2
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CBBAE

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_undefined_function
API String ID: 1552677711-2204979087
Opcode ID: 65a5335adb7ccc48d9f4ade7c086427e4461d71b89b18bf355e8d4f3e0295113
Instruction ID: 0091a31f0d9c3d3e4c707103096ee3fb7000c559a8dbdce6afaf1d5bbae9f8e4
Opcode Fuzzy Hash: 65a5335adb7ccc48d9f4ade7c086427e4461d71b89b18bf355e8d4f3e0295113
Instruction Fuzzy Hash: 8FE0EC19F2A14276F340F77098575F91210EF91390FD04031E00D42A9AEF2CA589C774

Function 00007FF8A81CBBF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CBBFD
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CBC15
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CBC26

Strings

ssl_undefined_function, xrefs: 00007FF8A81CBC02
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CBC0E

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_undefined_function
API String ID: 1552677711-2204979087
Opcode ID: e5d4594d72a90c4b0a88b7a81742d8e3e940df2a3f5ae6a7e67ec0bc632beab9
Instruction ID: 0091a31f0d9c3d3e4c707103096ee3fb7000c559a8dbdce6afaf1d5bbae9f8e4
Opcode Fuzzy Hash: e5d4594d72a90c4b0a88b7a81742d8e3e940df2a3f5ae6a7e67ec0bc632beab9
Instruction Fuzzy Hash: 8FE0EC19F2A14276F340F77098575F91210EF91390FD04031E00D42A9AEF2CA589C774

Function 00007FF8A81CBC50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81CBC5D
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81CBC75
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8A81CBC86

Strings

ssl_undefined_function, xrefs: 00007FF8A81CBC62
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A81CBC6E

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_undefined_function
API String ID: 1552677711-2204979087
Opcode ID: b2d1405cb58b5c5623c5942482346337c1b790aa5a6a1e377cca11eeeae03d46
Instruction ID: 0091a31f0d9c3d3e4c707103096ee3fb7000c559a8dbdce6afaf1d5bbae9f8e4
Opcode Fuzzy Hash: b2d1405cb58b5c5623c5942482346337c1b790aa5a6a1e377cca11eeeae03d46
Instruction Fuzzy Hash: 8FE0EC19F2A14276F340F77098575F91210EF91390FD04031E00D42A9AEF2CA589C774

Function 00007FF8B9F6A920 Relevance: 7.6, APIs: 5, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF8B9F6A99B
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6A9BD
DName::DName.LIBVCRUNTIME ref: 00007FF8B9F6A9CC
DName::DName.LIBVCRUNTIME ref: 00007FF8B9F6AA03
DName::DName.LIBVCRUNTIME ref: 00007FF8B9F6AA0E

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: f125dc20a4fc2cff283c2e4d5124f38be857c51718d1d3c9008137230ed817e4
Instruction ID: 3d824b325808095136967a09622561736de41bbab67ff809b561d84aa46bc543
Opcode Fuzzy Hash: f125dc20a4fc2cff283c2e4d5124f38be857c51718d1d3c9008137230ed817e4
Instruction Fuzzy Hash: 8D414822A19B92D8EB00DF29D8901B837B4BB15BE5BA66132EB4D53795DF3CE855C300

Function 00007FF8B8F72578 Relevance: 7.5, APIs: 5, Instructions: 33threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8B8F72589
PyThread_release_lock.PYTHON312 ref: 00007FF8B8F7259E
PyThread_free_lock.PYTHON312 ref: 00007FF8B8F725A8
PyObject_ClearWeakRefs.PYTHON312 ref: 00007FF8B8F725C0
_Py_Dealloc.PYTHON312 ref: 00007FF8B8F725E1

Memory Dump Source

Source File: 00000002.00000002.3309270963.00007FF8B8F71000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000002.00000002.3309240746.00007FF8B8F70000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309322062.00007FF8B8F73000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309340812.00007FF8B8F75000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309359337.00007FF8B8F76000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8f70000_0jNz7djbpp.jbxd

Similarity

API ID: Object_$ClearDeallocRefsThread_free_lockThread_release_lockTrackWeak
String ID:
API String ID: 778659985-0
Opcode ID: 4c2e9cd9dc90bcaed0c0b40945fb6d01ed7b17de78bc3f335a10123fcf14e4e5
Instruction ID: 69bd67373ea1f77de5d5d3b0442abb1b5d797ff148a3157ad2e14c06e68000ef
Opcode Fuzzy Hash: 4c2e9cd9dc90bcaed0c0b40945fb6d01ed7b17de78bc3f335a10123fcf14e4e5
Instruction Fuzzy Hash: 3701C83AA08A8392FB189F69E9553782B60FF45BD6F445030DB0A46764DF3CD496C305

Function 00007FF8B9F6470C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F66E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8B9F629EE), ref: 00007FF8B9F66E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F6488B

Strings

csm, xrefs: 00007FF8B9F6475B
, xrefs: 00007FF8B9F647DC
csm, xrefs: 00007FF8B9F648C5

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: abort
String ID: $csm$csm
API String ID: 4206212132-1512788406
Opcode ID: bd14039b9dc44c48f3afba7226bd4a8f48c08aeb5fb2f86f7c5774b76e28317a
Instruction ID: 87fe9a88b844edca7a81be8e63df6c04699d6eade4b7b923e10a5d65f9058d4f
Opcode Fuzzy Hash: bd14039b9dc44c48f3afba7226bd4a8f48c08aeb5fb2f86f7c5774b76e28317a
Instruction Fuzzy Hash: DB71BD32A087C186DB619F2AD09037D7BA0FB42BEAF14A135DB8D47B89CB2CD561C744

Function 00007FF8B9F644E4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F66E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8B9F629EE), ref: 00007FF8B9F66E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F645DB
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF8B9F645EB

Strings

csm, xrefs: 00007FF8B9F6463D
csm, xrefs: 00007FF8B9F6452E

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind
String ID: csm$csm
API String ID: 4108983575-3733052814
Opcode ID: 08ef0bffa0d8dc861c4a01b7d2fd628c67e896dc6c26123b9582640005c51e48
Instruction ID: 0f30fa8b4f6c4897b0b636a872c2d2be793d3b4b35d356b3f62553996132f6c5
Opcode Fuzzy Hash: 08ef0bffa0d8dc861c4a01b7d2fd628c67e896dc6c26123b9582640005c51e48
Instruction Fuzzy Hash: 87517E72D087C286EB64AF19D5442687AA0FB51BEAF146135DB8D47BD5CF3CE860CB00

Function 00007FF8A81BABB2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81BAC54
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81BAC6A
ERR_new.LIBCRYPTO-3 ref: 00007FF8A81BAD27
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81BAD3F

Strings

ssl3_change_cipher_state, xrefs: 00007FF8A81BAC59
..\s\ssl\s3_enc.c, xrefs: 00007FF8A81BAC63

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\s3_enc.c$ssl3_change_cipher_state
API String ID: 193678381-4073342769
Opcode ID: dceba1c64097241615e0fc1703333ee8f5fcd1dc3d3c998e940b48410fd7c00a
Instruction ID: 39efba7e762d56eca40a89b33e183263cd600f9fd6df302020e0c239bc12efb7
Opcode Fuzzy Hash: dceba1c64097241615e0fc1703333ee8f5fcd1dc3d3c998e940b48410fd7c00a
Instruction Fuzzy Hash: 6F01F563A0A24279F302DB11BC05AF96358FB887D8F440430EE4C02A56EF38D287C314

Function 00007FF8B9F6B118 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF8B9F6B172

Strings

%lf, xrefs: 00007FF8B9F6B1AD, 00007FF8B9F6B1E1, 00007FF8B9F6B211

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: 7e0deb2cf17bd330c849068a4ca2fc9bc064bfcc9212df10860184869afe9d43
Instruction ID: 94f92181f7501dac0aeeca91ec46e1965d73ab12c3ff662e90465781a9c48149
Opcode Fuzzy Hash: 7e0deb2cf17bd330c849068a4ca2fc9bc064bfcc9212df10860184869afe9d43
Instruction Fuzzy Hash: CD31C361A0CBC685E611DF69F8500BA77A1BF55BE3F54A236EB8E47791DE2CE141C300

Function 00007FF8A81B1A87 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

tls_construct_stoc_use_srtp, xrefs: 00007FF8A820A5BC
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A820A5C8

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_construct_stoc_use_srtp
API String ID: 0-3251434361
Opcode ID: 45b170a69d85541e434e019c63cc44df867896feb47ff342777d27cb72417df9
Instruction ID: 537667dcf9e32793e3b5368e1f472ffdadfedc581160139411488ebbbf9e9e42
Opcode Fuzzy Hash: 45b170a69d85541e434e019c63cc44df867896feb47ff342777d27cb72417df9
Instruction Fuzzy Hash: EF21B051F1B14265FB54A722E9457BA1265EF887C4F884030DD4D8BBCAEF2CE881C768

Function 00007FF8A81B1910 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A820CA01
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A820CA19

Strings

tls_parse_ctos_psk_kex_modes, xrefs: 00007FF8A820CA06
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A820CA12

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_psk_kex_modes
API String ID: 193678381-1556962829
Opcode ID: cdd95a2c04ed8f8ce0607f79ecbdc1296ad63eea15873b9a66f48712a1d54aff
Instruction ID: a6fa44bd0642182d253a9b4b6b54d089e565efb205872b94113c19f5367a2343
Opcode Fuzzy Hash: cdd95a2c04ed8f8ce0607f79ecbdc1296ad63eea15873b9a66f48712a1d54aff
Instruction Fuzzy Hash: 4421DBA2E0E286E6FB519B60D4055F97360FF993D8F145131DE8C46289EF1CEA90872C

Function 00007FF8A81B1AF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8209A4A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8209A62

Strings

tls_construct_stoc_next_proto_neg, xrefs: 00007FF8A8209A4F
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A8209A5B

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_construct_stoc_next_proto_neg
API String ID: 193678381-2301358877
Opcode ID: 86373516f0e2d0f54e3e4f290b2bbd539807c85866fdb5af1cf34785d53321ec
Instruction ID: ff6cc31bb36da9bb308a06ac1273e0b8f53b01ee09dd773561edcd0ad79781d0
Opcode Fuzzy Hash: 86373516f0e2d0f54e3e4f290b2bbd539807c85866fdb5af1cf34785d53321ec
Instruction Fuzzy Hash: 9A21D122B0E242A6EB50CB16E4457FA6364EBC57C8F484431EE4C47B9AEF3DD941CB54

Function 00007FF8A81FEC00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FEC3A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FEC52

Strings

final_early_data, xrefs: 00007FF8A81FEC3F
..\s\ssl\statem\extensions.c, xrefs: 00007FF8A81FEC4B

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions.c$final_early_data
API String ID: 193678381-1817123252
Opcode ID: 3a9a25aac602284c858c6e799458309d4d0e5e79e1dde57f44a79b01c9e08b2f
Instruction ID: 893827d6fd9455d2dee4a3e7a52af2d993d942a5b151048d5e0a48edd38237eb
Opcode Fuzzy Hash: 3a9a25aac602284c858c6e799458309d4d0e5e79e1dde57f44a79b01c9e08b2f
Instruction Fuzzy Hash: A6218E61E071429AFB66A629C44ABF82290FF447D8F584436E50C4A2D1DFBD9CC6CA68

Function 00007FF8A81B1AA5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8209DB8
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8209DD0

Strings

tls_construct_stoc_server_name, xrefs: 00007FF8A8209DBD
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A8209DC9

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_construct_stoc_server_name
API String ID: 193678381-1140354471
Opcode ID: 750eeb9985e7062bd7bd9dcf4792437d502d0fd801e853246b1c25637d4aad2e
Instruction ID: 4489137e56f49a6491593efc54e4268e45687a4d211f404d22c44e33a3ccc6d0
Opcode Fuzzy Hash: 750eeb9985e7062bd7bd9dcf4792437d502d0fd801e853246b1c25637d4aad2e
Instruction Fuzzy Hash: 7611DA21B4A185A6FB54E716E4857F96260EF847C4F584430DE0D876DBDF2CDC81C714

Function 00007FF8A81EEB60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FF8A81EEBC2
BIO_printf.LIBCRYPTO-3 ref: 00007FF8A81EEC03

Strings

UNKNOWN, xrefs: 00007FF8A81EEBE1
%s=0x%x (%s), xrefs: 00007FF8A81EEBF9

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_indentO_printf
String ID: %s=0x%x (%s)$UNKNOWN
API String ID: 1860387303-4219816433
Opcode ID: 99a4b063b3fab589dd76ce346bf8918259384f159b371a5cd85ffd6c809e88cb
Instruction ID: 2239ca87e0e7b8eb9e67b89e1c05e355c366a04d8f12a6d5faf099f5faef3f35
Opcode Fuzzy Hash: 99a4b063b3fab589dd76ce346bf8918259384f159b371a5cd85ffd6c809e88cb
Instruction Fuzzy Hash: A721A232A09B8596D7219F16E45013977A0F789BD0F444136EB9E43BE9EF3CD540C724

Function 00007FF8A8228C10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8228CAA
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A8228CC2

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8A8228CBB
tls_handle_status_request, xrefs: 00007FF8A8228CAF

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_srvr.c$tls_handle_status_request
API String ID: 193678381-662828239
Opcode ID: cb11e02509da6950250a63b60ff7b367a1c661b4e920f280ab37e77340e9698b
Instruction ID: 0422f8a0f3bfb809f9c43932b0dc6dc965fcf2138fd2df4d49433bee2bf244ed
Opcode Fuzzy Hash: cb11e02509da6950250a63b60ff7b367a1c661b4e920f280ab37e77340e9698b
Instruction Fuzzy Hash: 3A21A222B0B68295FB599B29C8483F82290EB85BD4F984035CD2C4B3D9EF3DD591C728

Function 00007FF8B8F725F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FF8B8F7261C
_PyArg_NoPositional.PYTHON312 ref: 00007FF8B8F72653
_PyArg_NoKeywords.PYTHON312 ref: 00007FF8B8F7267D

Strings

SimpleQueue, xrefs: 00007FF8B8F7264C, 00007FF8B8F72676

Memory Dump Source

Source File: 00000002.00000002.3309270963.00007FF8B8F71000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000002.00000002.3309240746.00007FF8B8F70000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309322062.00007FF8B8F73000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309340812.00007FF8B8F75000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309359337.00007FF8B8F76000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8f70000_0jNz7djbpp.jbxd

Similarity

API ID: Arg_$KeywordsModulePositionalType_
String ID: SimpleQueue
API String ID: 3925802263-3395603730
Opcode ID: b2ad81911b2a31d446dd87bc841229d8022e1abee216a269caa15919e66a9b65
Instruction ID: 2c7d97f6e14ce5d46150f5a4a6b22f8f4be29f7766af4fa3b37f2da986f5af77
Opcode Fuzzy Hash: b2ad81911b2a31d446dd87bc841229d8022e1abee216a269caa15919e66a9b65
Instruction Fuzzy Hash: E0113A3AB09E83A4FA508F1AE84056A6BA0BB44FC6F884032CF5D57754EF7CD4938708

Function 00007FF8A81B1B40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A821C19B
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A821C1B3

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FF8A821C1AC
dtls_construct_change_cipher_spec, xrefs: 00007FF8A821C1A0

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_dtls.c$dtls_construct_change_cipher_spec
API String ID: 193678381-1275380453
Opcode ID: de480bc5cc061fd9856c80761e82027197f765c8599161cb22b9137af11547ac
Instruction ID: cbf3da0cae33298f4f657ad762b3eab6cf684b5521b53d5bcadf442d6530cb0a
Opcode Fuzzy Hash: de480bc5cc061fd9856c80761e82027197f765c8599161cb22b9137af11547ac
Instruction Fuzzy Hash: 11018161F0A241A2E7519765D8497F82254EBD4BC4F544031DE4C47795EF2CD5C1C268

Function 00007FF8A81FEB50 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A81FEB91
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A81FEBA9

Strings

final_sig_algs, xrefs: 00007FF8A81FEB96
..\s\ssl\statem\extensions.c, xrefs: 00007FF8A81FEBA2

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions.c$final_sig_algs
API String ID: 193678381-3611835258
Opcode ID: 99d69e5dc2549d8c46bf470cb3db15e3bad882841d918bc8739831bfb958df0c
Instruction ID: b22cf77b58529ba52db7d0f40c12e6b3f1cc48624e91832cd36c860d5bc6f12f
Opcode Fuzzy Hash: 99d69e5dc2549d8c46bf470cb3db15e3bad882841d918bc8739831bfb958df0c
Instruction Fuzzy Hash: 2601A272E0A942A2F752E76DD845BF82340EF40784F844433D90D866E9DF6C99D1C629

Function 00007FF8A81EDBC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_printf.LIBCRYPTO-3(?,00007FF8A81EB04A), ref: 00007FF8A81EDC04
BIO_printf.LIBCRYPTO-3(?,00007FF8A81EB04A), ref: 00007FF8A81EDC1F

Strings

%02X, xrefs: 00007FF8A81EDC15
%s (len=%d): , xrefs: 00007FF8A81EDBF4

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_printf
String ID: %02X$%s (len=%d):
API String ID: 601296420-4138326432
Opcode ID: b1cb416e2851fcbc60b331d1da5903dd760c6e579c2d8ee3c5d157f5ed3d965a
Instruction ID: 3dec851fee5eb07adad7882354b452062582e4b63ac6363cd13c2f5d8f79b749
Opcode Fuzzy Hash: b1cb416e2851fcbc60b331d1da5903dd760c6e579c2d8ee3c5d157f5ed3d965a
Instruction Fuzzy Hash: 6D018F22B1BB52A5E611AB16A5404B8A721FB84FC0F085031FE4D0BB5ADF6CD541CB28

Function 00007FF8A81B197E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A8211289
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A82112A1

Strings

ossl_statem_client_process_message, xrefs: 00007FF8A821128E
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A821129A

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_clnt.c$ossl_statem_client_process_message
API String ID: 193678381-2227591447
Opcode ID: ef9702b7e38cf4233502a5ed84842f8ea6fc219b64a343c695ae01e4f52a91d7
Instruction ID: 61307794c9489076b62cd0e822923f5ef64bdb6937f73293c86c2ad3e798a673
Opcode Fuzzy Hash: ef9702b7e38cf4233502a5ed84842f8ea6fc219b64a343c695ae01e4f52a91d7
Instruction Fuzzy Hash: 1C01F272F1968196E300D765E8416F87754EF887D4F944132EA8C83BEAEF2CD601CB68

Function 00007FF8A81ED94A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FF8A81ED97C
BIO_printf.LIBCRYPTO-3 ref: 00007FF8A81ED9AF

Part of subcall function 00007FF8A81EDBC0: BIO_printf.LIBCRYPTO-3(?,00007FF8A81EB04A), ref: 00007FF8A81EDC04
Part of subcall function 00007FF8A81EDBC0: BIO_printf.LIBCRYPTO-3(?,00007FF8A81EB04A), ref: 00007FF8A81EDC1F

Strings

%s (%d), xrefs: 00007FF8A81ED9A2
unexpected value, xrefs: 00007FF8A81ED95B

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_printf$O_indent
String ID: %s (%d)$unexpected value
API String ID: 1715996925-1289549259
Opcode ID: a504f1d434ba6c65c5e8a6b1ab9fcb885afd620bd6019b5a06ca0e9c45058178
Instruction ID: cee5abaa328d743193f768f197b42cc9d5d910cc51193cbd996f13afbf3ff2f4
Opcode Fuzzy Hash: a504f1d434ba6c65c5e8a6b1ab9fcb885afd620bd6019b5a06ca0e9c45058178
Instruction Fuzzy Hash: 4EF062B1A0E642B2F7259B19D8015BC2A51FB81FC0F445932E95D176AAEF3CA641D33C

Function 00007FF8B9F62A50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F66E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8B9F629EE), ref: 00007FF8B9F66E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F62A8E

Strings

MOC, xrefs: 00007FF8B9F62A68
RCC, xrefs: 00007FF8B9F62A60
csm, xrefs: 00007FF8B9F62A70

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: 3ab94ae7472f91afbfb2fa40e8eaefdcfa6935c471aaf11af4776549d32657f7
Instruction ID: 478284a6a31a037766df26a918afe58d24840a9f1edfd0ccd208c74fc3d26a2e
Opcode Fuzzy Hash: 3ab94ae7472f91afbfb2fa40e8eaefdcfa6935c471aaf11af4776549d32657f7
Instruction Fuzzy Hash: EBF0493291878796E7646F69E1810AD37A4EF8CBE2F19A031D78846352CF7CE4A0CB41

Function 00007FF8A81B1B68 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8A820BEE9
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8A820BF01

Strings

tls_parse_ctos_post_handshake_auth, xrefs: 00007FF8A820BEEE
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A820BEFA

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\extensions_srvr.c$tls_parse_ctos_post_handshake_auth
API String ID: 193678381-3813554763
Opcode ID: a1339d128566fc28d5c2bdc317c878f2cf9bb78fbf4c3f09297f8e9a10dd56b0
Instruction ID: e080631a882dfeebfc84cfb0932adf870f09373f73ee32ba018cdd7c071e2262
Opcode Fuzzy Hash: a1339d128566fc28d5c2bdc317c878f2cf9bb78fbf4c3f09297f8e9a10dd56b0
Instruction Fuzzy Hash: F0F0A0B2F0B14666F350E7A0D80A7F92250EF84390F880430DA4C47ACAEF6CA9D5C638

Function 00007FF8B9F6A638 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F6CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6CE4D
Part of subcall function 00007FF8B9F6CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6CE86
Part of subcall function 00007FF8B9F6CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6D1B1

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6A793
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6A7F2
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6A824
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6A834

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: cc076bc81e8f2d48ba6aefa04368e4e4f2bc5c7ef048a26b3748b4f62f7846b0
Instruction ID: ce8eed7e0a0cc34b72fd8254b63570a889bf4deea6cd194ef819d1e4a99b5014
Opcode Fuzzy Hash: cc076bc81e8f2d48ba6aefa04368e4e4f2bc5c7ef048a26b3748b4f62f7846b0
Instruction Fuzzy Hash: D2913A62E08B9289FB518F68D8403AC3BB1BB047AAF955035DB4D17799DF7CE846C350

Function 00007FF8B9F6D274 Relevance: 6.1, APIs: 4, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F6ED94: Replicator::operator[].LIBVCRUNTIME ref: 00007FF8B9F6EDEE

Part of subcall function 00007FF8B9F6CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6CE4D
Part of subcall function 00007FF8B9F6CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6CE86
Part of subcall function 00007FF8B9F6CDBC: DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6D1B1

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6D2F4
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6D303
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6D380
DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6D38F

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID:
API String ID: 3863519203-0
Opcode ID: 57265f9aaea93611d8ae4b0edf9f43af56394ecd72ecd9aef4b3b93798ee479d
Instruction ID: 4c3e5b4fb387a1702b0b24d6aaf9b385203d66666a3ed768db33b000ec604e0b
Opcode Fuzzy Hash: 57265f9aaea93611d8ae4b0edf9f43af56394ecd72ecd9aef4b3b93798ee479d
Instruction Fuzzy Hash: 4E414772A08B8589EB01CF68D8413AC37A0FB49BA9F989039DB4D5B759DF7CD445C360

Function 00007FF8A81B1B27 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FF8A81F20FF
BN_bin2bn.LIBCRYPTO-3 ref: 00007FF8A81F2114
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FF8A81F212A
SRP_Calc_B_ex.LIBCRYPTO-3 ref: 00007FF8A81F2166

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: B_exCalc_D_priv_bytes_exL_cleanseN_bin2bn
String ID:
API String ID: 1900010111-0
Opcode ID: 26af03551079b2226ad3557e5d3309bc45daeb416e7ce2267ea2b5826f8dd582
Instruction ID: 2985b662871361e8b315ff500e1a543ed196fae1030cd68f3467dc54b0320d57
Opcode Fuzzy Hash: 26af03551079b2226ad3557e5d3309bc45daeb416e7ce2267ea2b5826f8dd582
Instruction Fuzzy Hash: F931612261AA4391EB91DF15D4547E933A0FB84BC8F580132DE4D4B799DF7CD841C764

Function 00007FF8A81F2B20 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

RAND_priv_bytes_ex.LIBCRYPTO-3 ref: 00007FF8A81F2B57
BN_bin2bn.LIBCRYPTO-3 ref: 00007FF8A81F2B71
OPENSSL_cleanse.LIBCRYPTO-3 ref: 00007FF8A81F2B87
SRP_Calc_A.LIBCRYPTO-3 ref: 00007FF8A81F2BA1

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: Calc_D_priv_bytes_exL_cleanseN_bin2bn
String ID:
API String ID: 2662037904-0
Opcode ID: 65c1bcf7c5f68ffab30a4f4844fe5b499fc2f157dc9c41be98c64b449794fa10
Instruction ID: 95e14098a642c9acdfc2e5906ba022a2314785ed4bae2db53339dc7c7430bcb5
Opcode Fuzzy Hash: 65c1bcf7c5f68ffab30a4f4844fe5b499fc2f157dc9c41be98c64b449794fa10
Instruction Fuzzy Hash: C211A77270698652FB419B25D4516FA2350FF88B88F440033DD4D8775AEF2CD241C724

Function 00007FF8A81B1C80 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

BIO_find_type.LIBCRYPTO-3 ref: 00007FF8A81B62E0
BIO_find_type.LIBCRYPTO-3 ref: 00007FF8A81B62F0
BIO_get_data.LIBCRYPTO-3 ref: 00007FF8A81B6305
BIO_get_data.LIBCRYPTO-3 ref: 00007FF8A81B6310

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_find_typeO_get_data
String ID:
API String ID: 280995463-0
Opcode ID: 0793b635f12887428af14e2403415325e3f0d94a68fe3922b5dad7fc621cca8e
Instruction ID: f5854932cda4eb1f2d4ad33f3903404e30d23347c3d1094e7366da267f29fc49
Opcode Fuzzy Hash: 0793b635f12887428af14e2403415325e3f0d94a68fe3922b5dad7fc621cca8e
Instruction Fuzzy Hash: 2B01B521F0F64255FF45E756A8092799294DF94BC0F584030EE6D8BB9EEF1CE5818728

Function 00007FF8B9F709FC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B9F70A28
GetCurrentThreadId.KERNEL32 ref: 00007FF8B9F70A36
GetCurrentProcessId.KERNEL32 ref: 00007FF8B9F70A42
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B9F70A52

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 74344bb322e65ea4bb1ed5ded81f371800f489492d84809563666ba838173471
Instruction ID: 9ca8352044e2257f7a05b13245ae251e1d4af69758ee5fe4e06664b572363678
Opcode Fuzzy Hash: 74344bb322e65ea4bb1ed5ded81f371800f489492d84809563666ba838173471
Instruction Fuzzy Hash: D5113C22B14F419AEB00CF64E8542B837A4FB19BA9F440E31DB6D877A4DF7CD1988340

Function 00007FF8B8F7166C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B8F71698
GetCurrentThreadId.KERNEL32 ref: 00007FF8B8F716A6
GetCurrentProcessId.KERNEL32 ref: 00007FF8B8F716B2
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B8F716C2

Memory Dump Source

Source File: 00000002.00000002.3309270963.00007FF8B8F71000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8B8F70000, based on PE: true

Associated: 00000002.00000002.3309240746.00007FF8B8F70000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309322062.00007FF8B8F73000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309340812.00007FF8B8F75000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.3309359337.00007FF8B8F76000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b8f70000_0jNz7djbpp.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: fc348722533f7bede41270b70dd1cf40f05866eac93c13f3ada98f936aa9b055
Instruction ID: 1d0d03db619deaf1823032c43b593b10fff2a06d27f6886f31b4b68a8e5fa862
Opcode Fuzzy Hash: fc348722533f7bede41270b70dd1cf40f05866eac93c13f3ada98f936aa9b055
Instruction Fuzzy Hash: B411303AB14F0299FB00CF64E8542B837A4FB19799F440D35DB6D867A4DF78D1998380

Function 00007FF8B9F6F670 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF8B9F6F732
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF8B9F6F435), ref: 00007FF8B9F6F78C

Strings

csm, xrefs: 00007FF8B9F6F719

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind
String ID: csm
API String ID: 451473138-1018135373
Opcode ID: 88d75f8372be57577a220e465c4aa8d65e851ebfefcdd899ecde71752cd89d28
Instruction ID: 8dd589892dcf39309ac1184f002fcfce61530105ad3518ef86ca45db0f2c9dbf
Opcode Fuzzy Hash: 88d75f8372be57577a220e465c4aa8d65e851ebfefcdd899ecde71752cd89d28
Instruction Fuzzy Hash: 8051BD32B197828AEB54CF29E544A7C37A1EB54BEAF209135DB5A43788DF7CE851C700

Function 00007FF8B9F64E40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F66E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8B9F629EE), ref: 00007FF8B9F66E56

_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF8B9F64F16
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F64F74

Strings

csm, xrefs: 00007FF8B9F6501A

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: abort$CreateFrameInfo
String ID: csm
API String ID: 2697087660-1018135373
Opcode ID: a8b8ee24cb783e7d293a6e1db454b28b1bfc46eb23a73e5049af87221528bbc6
Instruction ID: a374caf67dbcb8b14e77ebfc1013ced8dd0a5e9b1f9526efd1209bb704f94e01
Opcode Fuzzy Hash: a8b8ee24cb783e7d293a6e1db454b28b1bfc46eb23a73e5049af87221528bbc6
Instruction Fuzzy Hash: 31516E33A1878296E660EF29E04026E77A4FB8ABE2F141134EB8D47B55CF3CE450CB04

Function 00007FF8B9F6A524 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8B9F6A622

Strings

void, xrefs: 00007FF8B9F6A584
void , xrefs: 00007FF8B9F6A5AC

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: d81aed41cb4c8c5c69bd061dfd49733f36ea67ee8bb27e73bf8cb873ba0293ca
Instruction ID: 50e02da43d9ed30433ee454c90c922a6eba29c6052bf3011fa25831b1aaac6cc
Opcode Fuzzy Hash: d81aed41cb4c8c5c69bd061dfd49733f36ea67ee8bb27e73bf8cb873ba0293ca
Instruction Fuzzy Hash: 1D311462E18B959CFB01CFA8E8410EC3BB0BB48799B442536EF4E56B59EF3C9144C750

Function 00007FF8A81ECB0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FF8A81ECB6D
BIO_printf.LIBCRYPTO-3 ref: 00007FF8A81ECBAC
BIO_dump_indent.LIBCRYPTO-3(?,?,?,?,?,00007FF8A81ED420,?,?,?,?,?,?,00007FF8A81EB5F8), ref: 00007FF8A81ED029

Strings

%s (0x%04x), xrefs: 00007FF8A81ECBA2

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_dump_indentO_indentO_printf
String ID: %s (0x%04x)
API String ID: 2723189173-3351362759
Opcode ID: 13991b87e369eed1545d1192fceb5d0c9b50758468dd5dde525e0e2acae3d905
Instruction ID: 2238c9f96198eea678e2ac000b922b2285a1bc0a907c1d263f507de319d597d5
Opcode Fuzzy Hash: 13991b87e369eed1545d1192fceb5d0c9b50758468dd5dde525e0e2acae3d905
Instruction Fuzzy Hash: E111E632F1E59296EB268A19E5112BD6B91EB41BD4F484433CE5D03685EF2DE153C328

Function 00007FF8A81EC9CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FF8A81ECA2B
BIO_printf.LIBCRYPTO-3 ref: 00007FF8A81ECA5D
BIO_dump_indent.LIBCRYPTO-3(?,?,?,?,?,00007FF8A81ED420,?,?,?,?,?,?,00007FF8A81EB5F8), ref: 00007FF8A81ED029

Strings

%s (%d), xrefs: 00007FF8A81ECA53

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_dump_indentO_indentO_printf
String ID: %s (%d)
API String ID: 2723189173-2206749211
Opcode ID: 290cfd9f2578d6012c00051a70f6a5f3a31751d1fa2c3858a7e3bdbe74487c21
Instruction ID: 229f4aadf09ab106e2752515d8c984ac4b6730002acc6ebf19565d02eb44c0a3
Opcode Fuzzy Hash: 290cfd9f2578d6012c00051a70f6a5f3a31751d1fa2c3858a7e3bdbe74487c21
Instruction Fuzzy Hash: C811E222F1E69196EB62CA15990527A2B91EB85FD0F054433CE5D03785FF7DE143C368

Function 00007FF8A81EC93A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

BIO_indent.LIBCRYPTO-3 ref: 00007FF8A81EC980
BIO_printf.LIBCRYPTO-3 ref: 00007FF8A81EC9B7
BIO_dump_indent.LIBCRYPTO-3(?,?,?,?,?,00007FF8A81ED420,?,?,?,?,?,?,00007FF8A81EB5F8), ref: 00007FF8A81ED029

Strings

%s (%d), xrefs: 00007FF8A81EC9AD

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_dump_indentO_indentO_printf
String ID: %s (%d)
API String ID: 2723189173-2206749211
Opcode ID: b4332a9955e6fe1012b9039f8a517fb590b7966cde33bc4f5d3a56bbc90e9e3c
Instruction ID: 8c217ccae7847b63cc47c02250309c9267bc00bec63ccc294d7e27000101283d
Opcode Fuzzy Hash: b4332a9955e6fe1012b9039f8a517fb590b7966cde33bc4f5d3a56bbc90e9e3c
Instruction Fuzzy Hash: BD118E32A2E692E6EA528A15E4001B96B51EB85FD0F484433CE5E07799EF3DE543C728

Function 00007FF8B9F6676F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F66B10: RtlPcToFileHeader.KERNEL32 ref: 00007FF8B9F66B60
Part of subcall function 00007FF8B9F66B10: RaiseException.KERNEL32 ref: 00007FF8B9F66BA1

RtlPcToFileHeader.KERNEL32 ref: 00007FF8B9F667DF

Strings

Access violation - no RTTI data!, xrefs: 00007FF8B9F6676F
Bad dynamic_cast!, xrefs: 00007FF8B9F66792

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: 161e8b28e34caca24568961a6528755d3751e4ffa6d3c1bec0c9a5cac7a2823b
Instruction ID: eb19de9f364c485ca1c657c8a586ed434bb72ecd8358c8cecf024132abb500b9
Opcode Fuzzy Hash: 161e8b28e34caca24568961a6528755d3751e4ffa6d3c1bec0c9a5cac7a2823b
Instruction Fuzzy Hash: 07015EA1A19B87E2EE40DFACE4511786360EF81BEAF446431E70E07769EFACD508C700

Function 00007FF8B9F66B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF8B9F66B60
RaiseException.KERNEL32 ref: 00007FF8B9F66BA1

Strings

csm, xrefs: 00007FF8B9F66B8E

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 96783e5d5ee86e7ed91570add2de904558e3ade983638e121ecc73efc59d9239
Instruction ID: 139417cda1f7e53b5a329f65d0cdfc90856a7360f54a2769ab63ac4b39ebe225
Opcode Fuzzy Hash: 96783e5d5ee86e7ed91570add2de904558e3ade983638e121ecc73efc59d9239
Instruction Fuzzy Hash: F2111C32618F8192EB618F19F440259BBE5FB88B99F584231DB8C07768DF3DD551CB00

Function 00007FF8A8224C26 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3 ref: 00007FF8A8224C78
BIO_set_flags.LIBCRYPTO-3 ref: 00007FF8A8224C85

Strings

, xrefs: 00007FF8A8224CC8

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID:
API String ID: 3946675294-3916222277
Opcode ID: f459d6eae67273c59825f5057afe2b67be746f4c1442368492863615d66421ec
Instruction ID: 751e0cd0d4e81511c6dff544074fab86e6e8b3582ac5dbbd1042914f27a2e6d7
Opcode Fuzzy Hash: f459d6eae67273c59825f5057afe2b67be746f4c1442368492863615d66421ec
Instruction Fuzzy Hash: C8018162F0A24256FB659B69905537C2681EF84B84F984035CA1C0B7CAEF7DD8D5C728

Function 00007FF8A81C4BB6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3 ref: 00007FF8A81C4DD3

Strings

3DES(168), xrefs: 00007FF8A81C4BB6
SHA256, xrefs: 00007FF8A81C4D49

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_snprintf
String ID: 3DES(168)$SHA256
API String ID: 3142812517-1425382332
Opcode ID: 80c56bf669460c7ae283a5bb910a914187ca2ce988227b59e2b837bca9973e7f
Instruction ID: 6d3c8cabca650f7ec235a8133dcf944b1f919568da00a7189559ef487b61ccdb
Opcode Fuzzy Hash: 80c56bf669460c7ae283a5bb910a914187ca2ce988227b59e2b837bca9973e7f
Instruction Fuzzy Hash: 9401B1B2E0D681A1E2B2AB14B4440B96660FBA17D0F0405B2DF8C23A68CF3CE940D35C

Function 00007FF8A81C4BAA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3 ref: 00007FF8A81C4DD3

Strings

SHA256, xrefs: 00007FF8A81C4D49
DES(56), xrefs: 00007FF8A81C4BAA

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_snprintf
String ID: DES(56)$SHA256
API String ID: 3142812517-3688456565
Opcode ID: 330be10122b969ef588f184c2212ba202d4cac339f436a845f9b0d9464ea6a49
Instruction ID: 425531a1018be5a537287867fa6a2316d00b548dc3aacf0cfff92d5883e13f28
Opcode Fuzzy Hash: 330be10122b969ef588f184c2212ba202d4cac339f436a845f9b0d9464ea6a49
Instruction Fuzzy Hash: 5601D4B3E0E681A1E2B2AB14B4440B96660FBA17D0F0405B2DF8C23A68CF3CED40D25C

Function 00007FF8A81C4BDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3 ref: 00007FF8A81C4DD3

Strings

IDEA(128), xrefs: 00007FF8A81C4BDA
SHA256, xrefs: 00007FF8A81C4D49

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_snprintf
String ID: IDEA(128)$SHA256
API String ID: 3142812517-2727354722
Opcode ID: cb3cda230d24ffcfe9c2380903472647c70346dfab95449c4f7702e348b7fc2e
Instruction ID: 8442dd22dea7bfce25c32fd039d8ba22d9ae09263141d533f4571985ed784605
Opcode Fuzzy Hash: cb3cda230d24ffcfe9c2380903472647c70346dfab95449c4f7702e348b7fc2e
Instruction Fuzzy Hash: 0801D4B3E0E691A1E2B2AB14B4440B96660FBA17D0F0505B2DF8C23A68CF3CEC40D25C

Function 00007FF8A81C4BC2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3 ref: 00007FF8A81C4DD3

Strings

RC4(128), xrefs: 00007FF8A81C4BC2
SHA256, xrefs: 00007FF8A81C4D49

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_snprintf
String ID: RC4(128)$SHA256
API String ID: 3142812517-1400659560
Opcode ID: c19d1aa8b3c81704404ec0b3086f8eac485458e17100b68f60ba5578d7cc6a83
Instruction ID: e2ac16fad6c491dc0250d3b968e491b9c93baa976925a5f3615623a2dd9c4bb0
Opcode Fuzzy Hash: c19d1aa8b3c81704404ec0b3086f8eac485458e17100b68f60ba5578d7cc6a83
Instruction Fuzzy Hash: F601D4B3E0D681A1E2B2AB14B4440B96660FBA17D0F0405B2DF8C23A68CF3CED40D25C

Function 00007FF8A81C4BCE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

BIO_snprintf.LIBCRYPTO-3 ref: 00007FF8A81C4DD3

Strings

RC2(128), xrefs: 00007FF8A81C4BCE
SHA256, xrefs: 00007FF8A81C4D49

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_snprintf
String ID: RC2(128)$SHA256
API String ID: 3142812517-4086923701
Opcode ID: 24c1b70f5e47c98100c3f4ec21ce0afffd4d93cfd70c1fbf526dfc16ad58634e
Instruction ID: 18da6cc0eb61c1590e9a784ece600271f791cb8fc9bf6caf0ab6197f3e043b9b
Opcode Fuzzy Hash: 24c1b70f5e47c98100c3f4ec21ce0afffd4d93cfd70c1fbf526dfc16ad58634e
Instruction Fuzzy Hash: 9701D4B3E0D781A1E2B2AB14B4440B96660FBA17D0F0405B2DF8C23A68CF3CED40D25C

Function 00007FF8A81B8A20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FF8A81B8A46
SystemTimeToFileTime.KERNEL32 ref: 00007FF8A81B8A56

Strings

gfff, xrefs: 00007FF8A81B8A8A

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: 87700e89d8ba6b4a25f8f512b81ccb7933ee874b46122ca3b6fab96fdd1adfda
Instruction ID: 58cbebcfd80b4c9eb8bee85261ef93b0f20f1c155858ad61072d878dcbd89d0f
Opcode Fuzzy Hash: 87700e89d8ba6b4a25f8f512b81ccb7933ee874b46122ca3b6fab96fdd1adfda
Instruction Fuzzy Hash: D1012BE2B1954546DB50DB25F8012A967D0F7CC7C4F449032E68DC7769EF2CD241C710

Function 00007FF8A82119F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-3 ref: 00007FF8A821162C
BIO_set_flags.LIBCRYPTO-3 ref: 00007FF8A8211639

Strings

), xrefs: 00007FF8A82119FA

Memory Dump Source

Source File: 00000002.00000002.3304115522.00007FF8A81B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A81B0000, based on PE: true

Associated: 00000002.00000002.3304059965.00007FF8A81B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304115522.00007FF8A8232000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304177731.00007FF8A8234000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304201675.00007FF8A825C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8261000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A8267000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.3304217252.00007FF8A826F000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a81b0000_0jNz7djbpp.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: )
API String ID: 3946675294-2427484129
Opcode ID: 438bc311c8937f7332016279d50082aef9247e6290f68b5c09461b6884c0945f
Instruction ID: e556f34f05d2f0be06eb078e67a4c224db875ccfba5e0948bafbb2afedf0ceb5
Opcode Fuzzy Hash: 438bc311c8937f7332016279d50082aef9247e6290f68b5c09461b6884c0945f
Instruction Fuzzy Hash: D1F09632B0924156FB95DF15E08537C2391EB88BC4F585134CA5D4B78ADF3CD485C714

Function 00007FF8B9F6F420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9F66E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8B9F629EE), ref: 00007FF8B9F66E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9F6F45A

Strings

csm, xrefs: 00007FF8B9F6F43B
f, xrefs: 00007FF8B9F6F435

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: abortterminate
String ID: csm$f
API String ID: 661698970-629598281
Opcode ID: f31257b661c57643b6b4b1793288747ab2a9155158c122d579431834bbccefac
Instruction ID: 399f4d607298d6fc6c4d2769afbd47a98922be958465cdd830cbf39bf16bed9c
Opcode Fuzzy Hash: f31257b661c57643b6b4b1793288747ab2a9155158c122d579431834bbccefac
Instruction Fuzzy Hash: 8DE06532D087D291E7206F65F18013D2AA4AF5ABF6F34A034DB8806B46CE3DD490C745

Function 00007FF8B9F66E64 Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF8B9F66CE9,?,?,?,?,00007FF8B9F70582,?,?,?,?,?), ref: 00007FF8B9F66E83
SetLastError.KERNEL32(?,?,?,00007FF8B9F66CE9,?,?,?,?,00007FF8B9F70582,?,?,?,?,?), ref: 00007FF8B9F66F0C

Memory Dump Source

Source File: 00000002.00000002.3309985515.00007FF8B9F61000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF8B9F60000, based on PE: true

Associated: 00000002.00000002.3309964378.00007FF8B9F60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310040659.00007FF8B9F73000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310062824.00007FF8B9F78000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.3310137435.00007FF8B9F79000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b9f60000_0jNz7djbpp.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 29fbcb28d85caf8942357daff49778de6b87ab13b42ab574bfe6367f35ca65f9
Instruction ID: 70e77c9397db20f61023ed35a4d3a2617c6c218ea3627156750a466c11a38436
Opcode Fuzzy Hash: 29fbcb28d85caf8942357daff49778de6b87ab13b42ab574bfe6367f35ca65f9
Instruction Fuzzy Hash: D3113A20F19BC282FA159F6DE8501782691AF49BF6F185634DB6E077E9DE3CB841C610

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0jNz7djbpp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imaging.cp312-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingcms.cp312-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingmath.cp312-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_imagingtk.cp312-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\PIL\_webp.cp312-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI23522\VCRUNTIME140_1.dll

C:\Users\user\AppData\Local\Temp\_MEI23522\_asyncio.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\_cffi_backend.cp312-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\_multiprocessing.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\_overlapped.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI23522\_sqlite3.pyd

Windows Analysis Report
0jNz7djbpp.exe