Edit tour

Windows Analysis Report
shost.exe

Overview

General Information

Sample name:	shost.exe
Analysis ID:	1574328
MD5:	e6c0aa5771a46907706063ae1d8b4fb9
SHA1:	966ce51dfb51cf7e9db0c86eb35b964195c21bf2
SHA256:	b76d1577baac7071b5243e8639007e2cdd406258d6da07386fb0d638988d382f
Tags:	exegithub-com--hombozuser-JAMESWT_MHT
Infos:

Detection

Python Stealer, Muck Stealer

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Yara detected Muck Stealer

Found pyInstaller with non standard icon

Yara detected Generic Python Stealer

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

shost.exe (PID: 4576 cmdline: "C:\Users\user\Desktop\shost.exe" MD5: E6C0AA5771A46907706063AE1D8B4FB9)

shost.exe (PID: 1880 cmdline: "C:\Users\user\Desktop\shost.exe" MD5: E6C0AA5771A46907706063AE1D8B4FB9)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MuckStealer	Yara detected Muck Stealer	Joe Security
Process Memory Space: shost.exe PID: 1880	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: shost.exe PID: 1880	JoeSecurity_MuckStealer	Yara detected Muck Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://discord.gift/

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: shost.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\shost.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Jump to behavior

Source: shost.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: shost.exe, 00000002.00000002.3397673335.00007FFD94604000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: libcrypto-3.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: shost.exe, 00000002.00000002.3397048410.00007FFD940A2000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: shost.exe, 00000002.00000002.3397048410.00007FFD940A2000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: shost.exe, 00000000.00000003.2147965546.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3402353295.00007FFDA4341000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: shost.exe, 00000000.00000003.2147965546.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3402353295.00007FFDA4341000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: shost.exe, 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: params.pparams.qparams.gpub_keypriv_keyossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.4.0built on: Wed Nov 27 17:13:13 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/AOSSL_WINCTX: Undefinednot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: _rust.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: _rust.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3402885336.00007FFDA5493000.00000002.00000001.01000000.0000000E.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: shost.exe, 00000002.00000002.3402174547.00007FFDA4171000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3400953425.00007FFDA3AE7000.00000002.00000001.01000000.0000000B.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: shost.exe, 00000002.00000002.3400423691.00007FFDA3635000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3401137046.00007FFDA3C0C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3401665795.00007FFDA3FD2000.00000002.00000001.01000000.00000014.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: shost.exe, 00000002.00000002.3400767220.00007FFDA36D2000.00000002.00000001.01000000.00000010.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3402493283.00007FFDA4633000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3401137046.00007FFDA3C0C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: shost.exe, 00000000.00000003.2148472034.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3401258641.00007FFDA3C2D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3402694088.00007FFDA4DA4000.00000002.00000001.01000000.0000000F.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3400864209.00007FFDA3A89000.00000002.00000001.01000000.0000000D.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3402694088.00007FFDA4DA4000.00000002.00000001.01000000.0000000F.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: shost.exe, 00000002.00000002.3400178310.00007FFDA356F000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393377971.00000271C3D80000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: shost.exe, 00000002.00000002.3400423691.00007FFDA3635000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: shost.exe, 00000002.00000002.3400583397.00007FFDA368D000.00000002.00000001.01000000.00000012.sdmp, _ssl.pyd.0.dr

Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868892F0 FindFirstFileExW,FindClose,	0_2_00007FF7868892F0
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868A18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7868A18E4
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868883B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7868883B0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868892F0 FindFirstFileExW,FindClose,	2_2_00007FF7868892F0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868A18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7868A18E4
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868883B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7868883B0

Source: Joe Sandbox View

IP Address: 162.159.136.232 162.159.136.232

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: discord.com

Source: shost.exe, 00000002.00000002.3395139567.00000271C51A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C4432000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyusering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2FE000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2FE000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163525494.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163525494.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2183298432.00000271C4509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: shost.exe, 00000002.00000003.2181997484.00000271C49EE000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2188545898.00000271C4A4E000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2181997484.00000271C4A4E000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: shost.exe, 00000002.00000002.3393638342.00000271C41A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: shost.exe, 00000002.00000002.3393190973.00000271C2522000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: shost.exe, 00000002.00000002.3393800182.00000271C43A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlption
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: shost.exe, 00000002.00000002.3394201838.00000271C4B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crlY
Source: shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: shost.exe, 00000002.00000002.3394201838.00000271C4B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: shost.exe, 00000002.00000002.3394201838.00000271C4BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2FE000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2FE000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163525494.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: libcrypto-3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2FE000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C4432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3395139567.00000271C51A0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394675597.00000271C4C1F000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C43A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3395260651.00000271C5350000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3395139567.00000271C5288000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: shost.exe, 00000002.00000002.3395139567.00000271C51A0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394675597.00000271C4C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: shost.exe, 00000002.00000002.3394774822.00000271C4CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: shost.exe, 00000002.00000002.3394774822.00000271C4CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: shost.exe, 00000002.00000002.3394774822.00000271C4CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: shost.exe, 00000002.00000002.3393800182.00000271C43A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://i.instagram.com/api/v1/users/web_profile_info/?username=
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: shost.exe, 00000002.00000002.3394675597.00000271C4C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2FE000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163525494.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2FE000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163525494.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: shost.exe, 00000002.00000002.3394120888.00000271C47A0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394039523.00000271C46A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: shost.exe, 00000002.00000002.3395260651.00000271C5350000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3395260651.00000271C5314000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: shost.exe, 00000002.00000002.3393638342.00000271C41C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: shost.exe, 00000002.00000002.3395139567.00000271C51A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394675597.00000271C4C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: shost.exe, 00000002.00000002.3394675597.00000271C4C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: shost.exe, 00000002.00000002.3394675597.00000271C4C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: shost.exe, 00000002.00000002.3394675597.00000271C4C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm;;
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394675597.00000271C4C8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: shost.exe, 00000000.00000003.2166624742.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, LICENSE0.0.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: shost.exe, 00000000.00000003.2166624742.000002162E300000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166972393.000002162E301000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166624742.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, LICENSE0.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: shost.exe, 00000002.00000002.3394120888.00000271C47A0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2183564802.00000271C48C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/7
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/MJ
Source: shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163360306.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2164725093.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2FE000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2162142722.000002162E2F8000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: shost.exe, 00000002.00000003.2189919470.00000271C4A43000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: shost.exe, 00000002.00000002.3394201838.00000271C4BE3000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394675597.00000271C4C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aliexpress.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api19-va.tiktokv.com/aweme/v1/user/profile/self/?
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api19-va.tiktokv.com/aweme/v1/user/profile/self/?Sy
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://binance.com)
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: shost.exe, 00000002.00000002.3394923814.00000271C4EA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1086668425797058691/1113770559688413245/app.asar
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1135684724585681039/1143224080603037827/app.asar
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: _cffi_backend.cp312-win_amd64.pyd.0.dr	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://coinbase.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crunchyroll.com)
Source: shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io
Source: METADATA.0.dr	String found in binary or memory: https://cryptography.io/
Source: shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: _rust.pyd.0.dr	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com)
Source: shost.exe, 00000002.00000002.3395620767.00000271C5C74000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/users/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/guilds/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/guilds/N&
Source: shost.exe, 00000002.00000002.3394996590.00000271C4FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/users/
Source: shost.exe, 00000002.00000002.3394923814.00000271C4EA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1312770654163963904/AnlhEReW6Pv5NUYZVxbYpoMEbzRv54oRzr-s0adh4Xg17pk
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gift/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gift/c
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v6/users/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://disney.com)
Source: shost.exe, 00000002.00000002.3393638342.00000271C41C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393450092.00000271C3E60000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393450092.00000271C3EDC000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393450092.00000271C3EDC000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393450092.00000271C3EDC000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393450092.00000271C3EDC000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: shost.exe, 00000002.00000002.3393566020.00000271C40A0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: shost.exe, 00000002.00000002.3393566020.00000271C40A0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393450092.00000271C3EDC000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: shost.exe, 00000002.00000002.3393638342.00000271C41A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2170048153.00000271C41A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: shost.exe, 00000002.00000002.3394201838.00000271C4926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ebay.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://epicgames.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://expressvpn.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: shost.exe, 00000002.00000002.3394923814.00000271C4EA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://geolocation-db.com/jsonp/
Source: shost.exe, 00000002.00000002.3394774822.00000271C4CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com)
Source: shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: shost.exe, 00000002.00000002.3393638342.00000271C41A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2170048153.00000271C41A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/astral-sh/ruff
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/frankxrs
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/frankxrs/
Source: shost.exe, 00000002.00000002.3394774822.00000271C4CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: shost.exe, 00000002.00000002.3394774822.00000271C4CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: shost.exe, 00000002.00000002.3395260651.00000271C5314000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography
Source: shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/
Source: shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA.0.dr, _rust.pyd.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: _rust.pyd.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: _rust.pyd.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: shost.exe, 00000002.00000002.3394120888.00000271C47A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: shost.exe, 00000002.00000002.3394996590.00000271C4FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: shost.exe, 00000002.00000002.3394849814.00000271C4DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: shost.exe, 00000002.00000002.3394923814.00000271C4EA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml
Source: shost.exe, 00000002.00000002.3393450092.00000271C3EDC000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: shost.exe, 00000002.00000003.2170048153.00000271C41A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: shost.exe, 00000002.00000002.3393638342.00000271C41A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2170048153.00000271C41A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: shost.exe, 00000002.00000002.3393638342.00000271C41C3000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2179712377.00000271C4548000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2179677326.00000271C455A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: shost.exe, 00000002.00000002.3393638342.00000271C41A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2170048153.00000271C41A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: shost.exe, 00000002.00000002.3394201838.00000271C4A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: shost.exe, 00000002.00000002.3395139567.00000271C51A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: shost.exe, 00000002.00000002.3395139567.00000271C51A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gmail.com)
Source: shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: shost.exe, 00000002.00000002.3393800182.00000271C43A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hbo.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hotmail.com)
Source: shost.exe, 00000002.00000002.3394201838.00000271C4A87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: shost.exe, 00000002.00000002.3395260651.00000271C5350000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: shost.exe, 00000002.00000002.3394201838.00000271C4926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.imgur.com/Npe8QuD.png
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: METADATA0.0.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: shost.exe, 00000002.00000002.3394120888.00000271C47A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com)
Source: shost.exe, 00000002.00000002.3393800182.00000271C43A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4A9D000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4A87000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4B2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: shost.exe, 00000002.00000003.2188806016.00000271C4552000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2188409688.00000271C4A2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://minecraft.net)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nationsglory.fr/profile/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://netflix.com)
Source: shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://origin.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com)
Source: shost.exe, 00000002.00000002.3394996590.00000271C4FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: shost.exe, 00000002.00000002.3394996590.00000271C4FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: shost.exe, 00000002.00000002.3394996590.00000271C4FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/All
Source: shost.exe, 00000002.00000002.3393800182.00000271C43A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: shost.exe, 00000002.00000002.3394996590.00000271C4FA0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394923814.00000271C4EA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://paypal.com)
Source: shost.exe, 00000002.00000002.3394039523.00000271C46A0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2179781360.00000271C4537000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: shost.exe, 00000002.00000002.3397673335.00007FFD94604000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0685/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://playstation.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pornhub.com)
Source: shost.exe, 00000002.00000002.3394996590.00000271C4FA0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394849814.00000271C4DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://pypi.org/project/cryptography/
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://pypi.org/project/importlib_metadata
Source: shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: shost.exe, 00000002.00000002.3394774822.00000271C4CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: shost.exe, 00000002.00000002.3395260651.00000271C52D0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://riotgames.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://roblox.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sellix.io)
Source: shost.exe, 00000002.00000002.3394996590.00000271C4FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: shost.exe, 00000002.00000003.2177446786.00000271C4511000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2178091910.00000271C4511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: shost.exe, 00000002.00000003.2177559780.00000271C427A000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2178091910.00000271C44B1000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2178038087.00000271C449C000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C4432000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2178574762.00000271C4488000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2177446786.00000271C4511000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2179781360.00000271C447F000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2178091910.00000271C4511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: shost.exe, 00000002.00000002.3393959975.00000271C45A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: shost.exe, 00000002.00000003.2177446786.00000271C44D2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2177446786.00000271C4511000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2178091910.00000271C4511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:
Source: shost.exe, 00000002.00000003.2177446786.00000271C44D2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2177446786.00000271C4511000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2178091910.00000271C4511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:r;Nr
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://skins.nationsglory.fr/face/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spotify.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stake.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steam.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://telegram.com)
Source: shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: METADATA0.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com/
Source: shost.exe, 00000002.00000002.3393638342.00000271C41C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C4432000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: shost.exe, 00000002.00000002.3393800182.00000271C43A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2189400984.00000271C4A6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitch.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com)
Source: shost.exe, 00000002.00000002.3393638342.00000271C41C3000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://uber.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: shost.exe, 00000002.00000003.2181997484.00000271C49EE000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2188545898.00000271C4A4E000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2181997484.00000271C4A4E000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: shost.exe, 00000000.00000003.2154080870.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: shost.exe, 00000000.00000003.2154080870.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2154238011.000002162E2FF000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2154080870.000002162E2FF000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: shost.exe, 00000002.00000002.3393800182.00000271C43A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: shost.exe, 00000000.00000003.2163525494.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3400469731.00007FFDA3670000.00000002.00000001.01000000.00000013.sdmp, shost.exe, 00000002.00000002.3397353149.00007FFD941E3000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: shost.exe, 00000002.00000002.3394201838.00000271C4926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: shost.exe, 00000002.00000003.2188806016.00000271C4552000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2188409688.00000271C4A2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: shost.exe, 00000002.00000002.3393450092.00000271C3E60000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: shost.exe, 00000002.00000002.3398077900.00007FFD94774000.00000008.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: shost.exe, 00000002.00000002.3397673335.00007FFD94604000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: shost.exe, 00000002.00000002.3394201838.00000271C4926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/M
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://xbox.com)
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com)
Source: shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/
Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786881000	0_2_00007FF786881000
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786888BD0	0_2_00007FF786888BD0
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868A5C70	0_2_00007FF7868A5C70
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868A69D4	0_2_00007FF7868A69D4
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868A0938	0_2_00007FF7868A0938
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868917B0	0_2_00007FF7868917B0
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868A9798	0_2_00007FF7868A9798
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786891FD0	0_2_00007FF786891FD0
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786898804	0_2_00007FF786898804
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF78689DF60	0_2_00007FF78689DF60
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868A18E4	0_2_00007FF7868A18E4
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786889870	0_2_00007FF786889870
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786895DA0	0_2_00007FF786895DA0
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786891DC4	0_2_00007FF786891DC4
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF78689E5E0	0_2_00007FF78689E5E0
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786893610	0_2_00007FF786893610
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF78688AD1D	0_2_00007FF78688AD1D
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868A5EEC	0_2_00007FF7868A5EEC
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786899F10	0_2_00007FF786899F10
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786891BC0	0_2_00007FF786891BC0
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF78688A34B	0_2_00007FF78688A34B
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF78688A4E4	0_2_00007FF78688A4E4
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868A0938	0_2_00007FF7868A0938
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868A6488	0_2_00007FF7868A6488
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868A3C80	0_2_00007FF7868A3C80
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786892C80	0_2_00007FF786892C80
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868919B4	0_2_00007FF7868919B4
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868921D4	0_2_00007FF7868921D4
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786893A14	0_2_00007FF786893A14
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868A411C	0_2_00007FF7868A411C
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF786898154	0_2_00007FF786898154
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF78689DACC	0_2_00007FF78689DACC
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786881000	2_2_00007FF786881000
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868A69D4	2_2_00007FF7868A69D4
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868917B0	2_2_00007FF7868917B0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868A9798	2_2_00007FF7868A9798
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786891FD0	2_2_00007FF786891FD0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786898804	2_2_00007FF786898804
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF78689DF60	2_2_00007FF78689DF60
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868A18E4	2_2_00007FF7868A18E4
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786889870	2_2_00007FF786889870
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786895DA0	2_2_00007FF786895DA0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786891DC4	2_2_00007FF786891DC4
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF78689E5E0	2_2_00007FF78689E5E0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786893610	2_2_00007FF786893610
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF78688AD1D	2_2_00007FF78688AD1D
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868A5EEC	2_2_00007FF7868A5EEC
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786899F10	2_2_00007FF786899F10
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786888BD0	2_2_00007FF786888BD0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786891BC0	2_2_00007FF786891BC0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF78688A34B	2_2_00007FF78688A34B
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF78688A4E4	2_2_00007FF78688A4E4
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868A5C70	2_2_00007FF7868A5C70
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868A0938	2_2_00007FF7868A0938
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868A6488	2_2_00007FF7868A6488
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868A3C80	2_2_00007FF7868A3C80
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786892C80	2_2_00007FF786892C80
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868919B4	2_2_00007FF7868919B4
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868921D4	2_2_00007FF7868921D4
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786893A14	2_2_00007FF786893A14
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868A411C	2_2_00007FF7868A411C
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF786898154	2_2_00007FF786898154
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868A0938	2_2_00007FF7868A0938
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF78689DACC	2_2_00007FF78689DACC
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A76400	2_2_00007FFD93A76400
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A9D3F0	2_2_00007FFD93A9D3F0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AF73F0	2_2_00007FFD93AF73F0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AF8430	2_2_00007FFD93AF8430
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A74390	2_2_00007FFD93A74390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AB3370	2_2_00007FFD93AB3370
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93ADF360	2_2_00007FFD93ADF360
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AFE3D0	2_2_00007FFD93AFE3D0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AFA3A0	2_2_00007FFD93AFA3A0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A8B310	2_2_00007FFD93A8B310
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AE4310	2_2_00007FFD93AE4310
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A88290	2_2_00007FFD93A88290
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A952D0	2_2_00007FFD93A952D0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A962C0	2_2_00007FFD93A962C0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B11250	2_2_00007FFD93B11250
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B13210	2_2_00007FFD93B13210
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A8C1C0	2_2_00007FFD93A8C1C0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B24180	2_2_00007FFD93B24180
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A740F0	2_2_00007FFD93A740F0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B1B0F0	2_2_00007FFD93B1B0F0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A81120	2_2_00007FFD93A81120
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B1D0D0	2_2_00007FFD93B1D0D0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AD40D0	2_2_00007FFD93AD40D0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A870C0	2_2_00007FFD93A870C0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B12080	2_2_00007FFD93B12080
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B26090	2_2_00007FFD93B26090
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B2F840	2_2_00007FFD93B2F840
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A85850	2_2_00007FFD93A85850
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A72850	2_2_00007FFD93A72850
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AF1850	2_2_00007FFD93AF1850
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AD8770	2_2_00007FFD93AD8770
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AC87A0	2_2_00007FFD93AC87A0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A9C720	2_2_00007FFD93A9C720
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B046C0	2_2_00007FFD93B046C0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AAA6B5	2_2_00007FFD93AAA6B5
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93ACD6A0	2_2_00007FFD93ACD6A0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AA4610	2_2_00007FFD93AA4610
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A825F0	2_2_00007FFD93A825F0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A9F570	2_2_00007FFD93A9F570
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93ABE4F0	2_2_00007FFD93ABE4F0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AD94F0	2_2_00007FFD93AD94F0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AB9520	2_2_00007FFD93AB9520
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A9B490	2_2_00007FFD93A9B490
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A79480	2_2_00007FFD93A79480
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AF6BE0	2_2_00007FFD93AF6BE0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A8BB70	2_2_00007FFD93A8BB70
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B22B90	2_2_00007FFD93B22B90
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AD1A80	2_2_00007FFD93AD1A80
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AE9A70	2_2_00007FFD93AE9A70
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A7AAB0	2_2_00007FFD93A7AAB0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B04AB0	2_2_00007FFD93B04AB0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A90A50	2_2_00007FFD93A90A50
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A7E980	2_2_00007FFD93A7E980
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B23960	2_2_00007FFD93B23960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A76948	2_2_00007FFD93A76948
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AB5930	2_2_00007FFD93AB5930
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B208A0	2_2_00007FFD93B208A0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93ACF890	2_2_00007FFD93ACF890
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B15FB0	2_2_00007FFD93B15FB0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AF4FD0	2_2_00007FFD93AF4FD0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AE0FC0	2_2_00007FFD93AE0FC0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B24F20	2_2_00007FFD93B24F20
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A78F10	2_2_00007FFD93A78F10
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B16EF0	2_2_00007FFD93B16EF0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A9BF40	2_2_00007FFD93A9BF40
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93ADDE70	2_2_00007FFD93ADDE70
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AB7E10	2_2_00007FFD93AB7E10
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AC8DF0	2_2_00007FFD93AC8DF0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B12DE0	2_2_00007FFD93B12DE0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A7FD60	2_2_00007FFD93A7FD60
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A88CF0	2_2_00007FFD93A88CF0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A76D42	2_2_00007FFD93A76D42
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A92D20	2_2_00007FFD93A92D20
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A97C90	2_2_00007FFD93A97C90
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93AC9CD0	2_2_00007FFD93AC9CD0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93A73CA0	2_2_00007FFD93A73CA0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93BE12F0	2_2_00007FFD93BE12F0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93BE18A0	2_2_00007FFD93BE18A0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9DF423E0	2_2_00007FFD9DF423E0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9DF41FB0	2_2_00007FFD9DF41FB0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9E844810	2_2_00007FFD9E844810
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9E8445C0	2_2_00007FFD9E8445C0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9E851D70	2_2_00007FFD9E851D70
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9E851FE0	2_2_00007FFD9E851FE0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9E852490	2_2_00007FFD9E852490
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9E8529B0	2_2_00007FFD9E8529B0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9E852EB0	2_2_00007FFD9E852EB0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9E853520	2_2_00007FFD9E853520
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3B2120	2_2_00007FFD9F3B2120
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3B1D30	2_2_00007FFD9F3B1D30
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3C21E0	2_2_00007FFD9F3C21E0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3C1F00	2_2_00007FFD9F3C1F00
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3E1F80	2_2_00007FFD9F3E1F80
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F7F2270	2_2_00007FFD9F7F2270
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F7F2380	2_2_00007FFD9F7F2380
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F7F1D30	2_2_00007FFD9F7F1D30
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA0862280	2_2_00007FFDA0862280
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA0861D30	2_2_00007FFDA0861D30
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA0872150	2_2_00007FFDA0872150
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA2E91FE0	2_2_00007FFDA2E91FE0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA32F2230	2_2_00007FFDA32F2230
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA3567C48	2_2_00007FFDA3567C48

Source: C:\Users\user\Desktop\shost.exe	Code function: String function: 00007FFD93A9FEC0 appears 38 times
Source: C:\Users\user\Desktop\shost.exe	Code function: String function: 00007FFD93A78E10 appears 129 times
Source: C:\Users\user\Desktop\shost.exe	Code function: String function: 00007FF786882710 appears 104 times
Source: C:\Users\user\Desktop\shost.exe	Code function: String function: 00007FFD93A79D60 appears 171 times
Source: C:\Users\user\Desktop\shost.exe	Code function: String function: 00007FF786882910 appears 34 times
Source: C:\Users\user\Desktop\shost.exe	Code function: String function: 00007FFD93A78C40 appears 31 times

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.0.dr

Static PE information: No import functions for PE file found

Source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs shost.exe
Source: shost.exe, 00000000.00000003.2147965546.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs shost.exe
Source: shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2150843940.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2163793545.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2148885023.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2163525494.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs shost.exe
Source: shost.exe, 00000000.00000003.2148472034.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs shost.exe
Source: shost.exe, 00000000.00000003.2167542529.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs shost.exe
Source: shost.exe, 00000000.00000003.2151340851.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs shost.exe
Source: shost.exe	Binary or memory string: OriginalFilename vs shost.exe
Source: shost.exe, 00000002.00000002.3401027695.00007FFDA3AEE000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs shost.exe
Source: shost.exe, 00000002.00000002.3398514967.00007FFD9489D000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs shost.exe
Source: shost.exe, 00000002.00000002.3402958118.00007FFDA5496000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs shost.exe
Source: shost.exe, 00000002.00000002.3401929740.00007FFDA3FD4000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs shost.exe
Source: shost.exe, 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs shost.exe
Source: shost.exe, 00000002.00000002.3400469731.00007FFDA3670000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamelibsslH vs shost.exe
Source: shost.exe, 00000002.00000002.3402794084.00007FFDA4DA7000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs shost.exe
Source: shost.exe, 00000002.00000002.3400217598.00007FFDA357B000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs shost.exe
Source: shost.exe, 00000002.00000002.3400699710.00007FFDA36A9000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs shost.exe
Source: shost.exe, 00000002.00000002.3401339673.00007FFDA3C32000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs shost.exe
Source: shost.exe, 00000002.00000002.3402410988.00007FFDA4347000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs shost.exe
Source: shost.exe, 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs shost.exe
Source: shost.exe, 00000002.00000002.3401199055.00007FFDA3C15000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs shost.exe
Source: shost.exe, 00000002.00000002.3400902578.00007FFDA3A93000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs shost.exe
Source: shost.exe, 00000002.00000002.3397353149.00007FFD941E3000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs shost.exe
Source: shost.exe, 00000002.00000002.3402554005.00007FFDA4636000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs shost.exe
Source: shost.exe, 00000002.00000002.3402274238.00007FFDA417C000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs shost.exe
Source: shost.exe, 00000002.00000002.3393377971.00000271C3D80000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs shost.exe
Source: shost.exe, 00000002.00000002.3400807281.00007FFDA36DD000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs shost.exe

Source: classification engine

Classification label: mal72.troj.winEXE@3/92@1/1

Source: C:\Users\user\Desktop\shost.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI45762

Jump to behavior

Source: shost.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\shost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT action_url, username_value, password_value FROM logins;
Source: shost.exe, 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: shost.exe, 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: shost.exe, 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: shost.exe, 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: shost.exe, shost.exe, 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: shost.exe, 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: shost.exe, 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: shost.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\shost.exe

File read: C:\Users\user\Desktop\shost.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\shost.exe "C:\Users\user\Desktop\shost.exe"
Source: C:\Users\user\Desktop\shost.exe	Process created: C:\Users\user\Desktop\shost.exe "C:\Users\user\Desktop\shost.exe"
Source: C:\Users\user\Desktop\shost.exe	Process created: C:\Users\user\Desktop\shost.exe "C:\Users\user\Desktop\shost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\shost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Section loaded: wintypes.dll	Jump to behavior

Source: shost.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: shost.exe

Static file information: File size 16895360 > 1048576

Source: shost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: shost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: shost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: shost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: shost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: shost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: shost.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: shost.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: shost.exe, 00000002.00000002.3397673335.00007FFD94604000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: libcrypto-3.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: shost.exe, 00000002.00000002.3397048410.00007FFD940A2000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: shost.exe, 00000002.00000002.3397048410.00007FFD940A2000.00000002.00000001.01000000.0000000C.sdmp, libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: shost.exe, 00000000.00000003.2149849739.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: shost.exe, 00000000.00000003.2147965546.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3402353295.00007FFDA4341000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: shost.exe, 00000000.00000003.2147965546.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3402353295.00007FFDA4341000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: shost.exe, 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: libcrypto-3.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: shost.exe, 00000000.00000003.2149757276.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: params.pparams.qparams.gpub_keypriv_keyossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.4.0built on: Wed Nov 27 17:13:13 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/AOSSL_WINCTX: Undefinednot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: _rust.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: _rust.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: shost.exe, 00000000.00000003.2166483174.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3402885336.00007FFDA5493000.00000002.00000001.01000000.0000000E.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: shost.exe, 00000002.00000002.3402174547.00007FFDA4171000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: shost.exe, 00000000.00000003.2149376456.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3400953425.00007FFDA3AE7000.00000002.00000001.01000000.0000000B.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: shost.exe, 00000002.00000002.3400423691.00007FFDA3635000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3401137046.00007FFDA3C0C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: shost.exe, 00000000.00000003.2151576333.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3401665795.00007FFDA3FD2000.00000002.00000001.01000000.00000014.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: shost.exe, 00000000.00000003.2148153901.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: shost.exe, 00000002.00000002.3400767220.00007FFDA36D2000.00000002.00000001.01000000.00000010.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: shost.exe, 00000000.00000003.2150128357.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3402493283.00007FFDA4633000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: shost.exe, 00000000.00000003.2149510097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3401137046.00007FFDA3C0C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: shost.exe, 00000000.00000003.2148472034.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3401258641.00007FFDA3C2D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3402694088.00007FFDA4DA4000.00000002.00000001.01000000.0000000F.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: shost.exe, 00000000.00000003.2150452756.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3400864209.00007FFDA3A89000.00000002.00000001.01000000.0000000D.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: shost.exe, 00000000.00000003.2151891097.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3402694088.00007FFDA4DA4000.00000002.00000001.01000000.0000000F.sdmp, _wmi.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: shost.exe, 00000002.00000002.3400178310.00007FFDA356F000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: shost.exe, 00000000.00000003.2163947986.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393377971.00000271C3D80000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: shost.exe, 00000002.00000002.3400423691.00007FFDA3635000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: shost.exe, 00000002.00000002.3400583397.00007FFDA368D000.00000002.00000001.01000000.00000012.sdmp, _ssl.pyd.0.dr

Source: shost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: shost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: shost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: shost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: shost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\shost.exe

Process created: "C:\Users\user\Desktop\shost.exe"

Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_chacha20.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\shost.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Jump to behavior

Source: C:\Users\user\Desktop\shost.exe

Code function: 0_2_00007FF786885820 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF786885820

Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\shost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_chacha20.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\shost.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-18160

Source: C:\Users\user\Desktop\shost.exe

API coverage: 1.5 %

Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868892F0 FindFirstFileExW,FindClose,	0_2_00007FF7868892F0
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868A18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7868A18E4
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF7868883B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7868883B0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868892F0 FindFirstFileExW,FindClose,	2_2_00007FF7868892F0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868A18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7868A18E4
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF7868883B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7868883B0

Source: C:\Users\user\Desktop\shost.exe

Code function: 2_2_00007FFD93A80180 GetSystemInfo,

2_2_00007FFD93A80180

Source: shost.exe, 00000000.00000003.2152514142.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: shost.exe, 00000002.00000002.3393638342.00000271C41C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Source: C:\Users\user\Desktop\shost.exe

Code function: 0_2_00007FF78689A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF78689A684

Source: C:\Users\user\Desktop\shost.exe

Code function: 0_2_00007FF7868A34F0 GetProcessHeap,

0_2_00007FF7868A34F0

Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF78688C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF78688C910
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF78689A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF78689A684
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF78688D37C SetUnhandledExceptionFilter,	0_2_00007FF78688D37C
Source: C:\Users\user\Desktop\shost.exe	Code function: 0_2_00007FF78688D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF78688D19C
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF78688C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF78688C910
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF78689A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF78689A684
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF78688D37C SetUnhandledExceptionFilter,	2_2_00007FF78688D37C
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FF78688D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF78688D19C
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93B9CAF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD93B9CAF0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93BE2AA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD93BE2AA0
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD93BE3068 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD93BE3068
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9DF41960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD9DF41960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9DF41390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD9DF41390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9E841960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD9E841960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9E841390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD9E841390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9E851960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD9E851960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9E851390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD9E851390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3B1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD9F3B1960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3B1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD9F3B1390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3C1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD9F3C1960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3C1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD9F3C1390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3D1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD9F3D1960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3D1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD9F3D1390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3E1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD9F3E1960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F3E1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD9F3E1390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F7F1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFD9F7F1960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFD9F7F1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFD9F7F1390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA0861960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA0861960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA0861390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDA0861390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA0871960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA0871960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA0871390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDA0871390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA2E91390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDA2E91390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA2E91960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA2E91960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA2EA1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDA2EA1390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA2EA1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA2EA1960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA32F1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDA32F1390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA32F1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA32F1960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA3521390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDA3521390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA3521960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA3521960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA3531390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDA3531390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA3531960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA3531960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA3541390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDA3541390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA3541960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA3541960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA3551390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFDA3551390
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA3551960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA3551960
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA356BEB0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFDA356BEB0

Source: C:\Users\user\Desktop\shost.exe

Process created: C:\Users\user\Desktop\shost.exe "C:\Users\user\Desktop\shost.exe"

Jump to behavior

Source: C:\Users\user\Desktop\shost.exe

Code function: 0_2_00007FF7868A95E0 cpuid

0_2_00007FF7868A95E0

Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info\licenses VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\jaraco VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer\md.cp312-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer\md__mypyc.cp312-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shost.exe	Queries volume information: C:\Users\user\Desktop\shost.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\shost.exe

Code function: 0_2_00007FF78688D080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF78688D080

Source: C:\Users\user\Desktop\shost.exe

Code function: 0_2_00007FF7868A5C70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7868A5C70

Stealing of Sensitive Information

Yara detected Muck Stealer

Source: Yara match	File source: 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shost.exe PID: 1880, type: MEMORYSTR

Yara detected Generic Python Stealer

Source: Yara match

File source: Process Memory Space: shost.exe PID: 1880, type: MEMORYSTR

Remote Access Functionality

Yara detected Muck Stealer

Source: Yara match	File source: 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shost.exe PID: 1880, type: MEMORYSTR

Yara detected Generic Python Stealer

Source: Yara match

File source: Process Memory Space: shost.exe PID: 1880, type: MEMORYSTR

Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA3566B84 PyFloat_Type,PyUnicode_AsUTF8AndSize,sqlite3_bind_text,PyObject_CheckBuffer,PyErr_Format,sqlite3_bind_null,PyObject_GetBuffer,PyExc_OverflowError,PyErr_SetString,PyBuffer_Release,sqlite3_bind_blob,PyBuffer_Release,PyExc_OverflowError,PyErr_SetString,PyFloat_AsDouble,PyErr_Occurred,sqlite3_bind_double,PyErr_Occurred,sqlite3_bind_int64,		2_2_00007FFDA3566B84
Source: C:\Users\user\Desktop\shost.exe	Code function: 2_2_00007FFDA3564ED0 PyEval_SaveThread,sqlite3_bind_parameter_count,PyEval_RestoreThread,PyTuple_Type,sqlite3_bind_parameter_name,PyLong_Type,PyFloat_Type,PyUnicode_Type,PyLong_AsLongLongAndOverflow,sqlite3_bind_int64,_Py_Dealloc,PyUnicode_AsUTF8AndSize,sqlite3_bind_text,PyTuple_Pack,PyDict_GetItemWithError,_Py_Dealloc,PyErr_Occurred,_PyObject_LookupAttr,_PyObject_LookupAttr,PyLong_Type,PyFloat_Type,PyUnicode_Type,PyType_IsSubtype,PyObject_CheckBuffer,PyObject_GetBuffer,sqlite3_bind_blob,PyBuffer_Release,sqlite3_bind_null,PyFloat_AsDouble,sqlite3_bind_double,PyEval_SaveThread,sqlite3_bind_parameter_name,PyEval_RestoreThread,PyUnicode_FromString,PyDict_Type,PyDict_GetItemWithError,_Py_Dealloc,PyErr_GetRaisedException,sqlite3_db_handle,_PyErr_ChainExceptions1,PyExc_DeprecationWarning,PyErr_WarnFormat,PyList_GetItem,PyObject_CallOneArg,PyErr_Occurred,PyExc_OverflowError,PyErr_SetString,PyErr_Occurred,PyErr_Format,PyObject_CallOneArg,_Py_Dealloc,PyExc_TypeError,PyErr_ExceptionMatches,PyErr_Clear,PySequence_Check,PyTuple_Type,PyErr_GetRaisedException,sqlite3_db_handle,_PyErr_ChainExceptions1,PySequence_Size,PyErr_Format,PyObject_GetItem,PyErr_Occurred,PyErr_Format,PyErr_Format,PyErr_SetString,PySequence_GetItem,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,PyExc_LookupError,PyErr_ExceptionMatches,_Py_Dealloc,PyObject_CallOneArg,_Py_Dealloc,_Py_Dealloc,PyExc_TypeError,PyErr_ExceptionMatches,PyErr_Clear,_Py_Dealloc,PyExc_OverflowError,PyErr_SetString,PyBuffer_Release,PyExc_OverflowError,PyErr_SetString,PyErr_Occurred,		2_2_00007FFDA3564ED0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
shost.exe	55%	ReversingLabs	Win64.Trojan.CrealStealer

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_curve25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_curve448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_cffi_backend.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer\md.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI45762\libssl-3.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:	0%	Avira URL Cloud	safe
https://nationsglory.fr/profile/	0%	Avira URL Cloud	safe
https://discord.gift/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
discord.com	162.159.136.232	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://nationsglory.fr/profile/	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pyca/cryptography/issues/8996	_rust.pyd.0.dr	false		high
https://github.com/astral-sh/ruff	shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://discord.gift/	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	shost.exe, 00000002.00000002.3393959975.00000271C45A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg	shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
http://crl.dhimyotis.com/certignarootca.crl0	shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://coinbase.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tiktok.com/	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/issues	shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://tiktok.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/	shost.exe, 00000002.00000002.3395620767.00000271C5C74000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	shost.exe, 00000002.00000002.3393638342.00000271C41A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2170048153.00000271C41A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api19-va.tiktokv.com/aweme/v1/user/profile/self/?	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://importlib-metadata.readthedocs.io/	METADATA0.0.dr	false		high
https://www.apache.org/licenses/LICENSE-2.0	shost.exe, 00000000.00000003.2154080870.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2154238011.000002162E2FF000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2154080870.000002162E2FF000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	false		high
https://packaging.python.org/en/latest/specifications/core-metadata/	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	shost.exe, 00000002.00000002.3393638342.00000271C41C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://paypal.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	shost.exe, 00000002.00000002.3394120888.00000271C47A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api19-va.tiktokv.com/aweme/v1/user/profile/self/?Sy	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://i.instagram.com/api/v1/users/web_profile_info/?username=	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://readthedocs.org/projects/importlib-metadata/badge/?version=latest	shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	shost.exe, 00000002.00000002.3394774822.00000271C4CA0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/v9/users/	shost.exe, 00000002.00000002.3394923814.00000271C4EA0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://xbox.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://youtube.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://blog.jaraco.com/skeleton	shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://tools.ietf.org/html/rfc3610	shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C4432000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/platformdirs/platformdirs	shost.exe, 00000002.00000002.3394774822.00000271C4CA0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	shost.exe, 00000002.00000002.3395139567.00000271C51A0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394675597.00000271C4C16000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:	shost.exe, 00000002.00000003.2177446786.00000271C44D2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2177446786.00000271C4511000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2178091910.00000271C4511000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393450092.00000271C3E60000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://crunchyroll.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.instagram.com/	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pypi.org/project/build/).	shost.exe, 00000002.00000002.3394996590.00000271C4FA0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394849814.00000271C4DA0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	shost.exe, 00000002.00000002.3393638342.00000271C41A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2170048153.00000271C41A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	shost.exe, 00000002.00000002.3393638342.00000271C41C3000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2179712377.00000271C4548000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2179677326.00000271C455A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ebay.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/	shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	shost.exe, 00000000.00000003.2154080870.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	false		high
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	_rust.pyd.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	shost.exe, 00000002.00000002.3393566020.00000271C40A0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	shost.exe, 00000002.00000002.3393566020.00000271C40A0000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://playstation.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://img.shields.io/badge/skeleton-2024-informational	shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the	shost.exe, 00000002.00000002.3393800182.00000271C43A0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/installation/	shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://sellix.io)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	shost.exe, 00000002.00000002.3394849814.00000271C4DA0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/attachments/1086668425797058691/1113770559688413245/app.asar	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394675597.00000271C4C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	shost.exe, 00000002.00000002.3395139567.00000271C51A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/v6/guilds/	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	shost.exe, 00000002.00000002.3394201838.00000271C48A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4B84000.00000004.00000020.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/v/importlib_metadata.svg	shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://github.com/jaraco/jaraco.functools/issues/5	shost.exe, 00000002.00000002.3394774822.00000271C4CA0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es00	shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394675597.00000271C4C8A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.rfc-editor.org/info/rfc7253	shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues	METADATA.0.dr, _rust.pyd.0.dr	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	shost.exe, 00000002.00000002.3394201838.00000271C4A9D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	shost.exe, 00000002.00000003.2188806016.00000271C4552000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393800182.00000271C44DD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2188409688.00000271C4A2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	shost.exe, 00000002.00000002.3393800182.00000271C43A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2189400984.00000271C4A6A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/	METADATA.0.dr	false		high
http://www.accv.es/legislacion_c.htm;;	shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.gg/	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.firmaprofesional.com/cps0	shost.exe, 00000002.00000002.3395394965.00000271C53D0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3394201838.00000271C4A9D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000002.3393450092.00000271C3EDC000.00000004.00001000.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://netflix.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	shost.exe, 00000002.00000002.3395139567.00000271C51A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://gmail.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	shost.exe, 00000002.00000002.3394201838.00000271C4B2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	shost.exe, 00000002.00000002.3393638342.00000271C41A0000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169919471.00000271C41A2000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2169899700.00000271C41AD000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000002.00000003.2170048153.00000271C41A6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22	shost.exe, 00000000.00000003.2166700400.000002162E2F3000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.dr	false		high
https://github.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cacerts.digicert.co	shost.exe, 00000000.00000003.2168055089.000002162E2F4000.00000004.00000020.00020000.00000000.sdmp, shost.exe, 00000000.00000003.2149033292.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp	false		high
https://binance.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/changelog/	shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://spotify.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-	shost.exe, 00000002.00000002.3395394965.00000271C54A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues/9253	_rust.pyd.0.dr	false		high
https://mail.python.org/mailman/listinfo/cryptography-dev	shost.exe, 00000000.00000003.2153540570.000002162E2F2000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://github.com/pypa/setuptools/issues/new?template=distutils-deprecation.yml	shost.exe, 00000002.00000002.3394923814.00000271C4EA0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crlY	shost.exe, 00000002.00000002.3394201838.00000271C4A15000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/library/itertools.html#recipes	shost.exe, 00000002.00000002.3394774822.00000271C4CA0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/users/	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.gofile.io/getServer	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steam.com)	shost.exe, 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.136.232	discord.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574328
Start date and time:	2024-12-13 08:42:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	shost.exe
Detection:	MAL
Classification:	mal72.troj.winEXE@3/92@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.109.210.53
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
VT rate limit hit for: shost.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.136.232	S23UhdW5DH.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc	Browse	discord.com/administrator/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	WE8zqotCFj.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.137.232
	ozAxx9uGHu.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.136.232
	eCXXUk54sx.exe	Get hash	malicious	Divulge Stealer	Browse	162.159.128.233
	apDMcnqqWs.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	https://github.com/Matty77o/malware-samples-m-h/blob/main/TheTrueFriend.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRAT	Browse	162.159.128.233
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	162.159.128.233
	file.exe	Get hash	malicious	Blank Grabber	Browse	162.159.136.232
	xooSsYaHN0.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	162.159.128.233
	IErMYVWrv9.exe	Get hash	malicious	Python Stealer, Luna Grabber, Luna Logger	Browse	162.159.135.232

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	main.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	in.exe	Get hash	malicious	Babadeda, HTMLPhisher	Browse	104.17.25.14
	CVmkXJ7e0a.exe	Get hash	malicious	SheetRat	Browse	104.16.185.241
	naukri-launcher 10.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	WE8zqotCFj.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.137.232
	ozAxx9uGHu.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.136.232
	naukri-launcher 10.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	eCXXUk54sx.exe	Get hash	malicious	Divulge Stealer	Browse	162.159.128.233
	ZS8xEqirxa.exe	Get hash	malicious	LummaC	Browse	104.21.27.188
	wV1Mk5PUmi.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_ARC4.pyd	lz4wnSavmK.exe	Get hash	malicious	Python Stealer	Browse
	WVuXCNNYG0.exe	Get hash	malicious	Python Stealer	Browse
	dipwo1iToJ.exe	Get hash	malicious	Python Stealer	Browse
	ROh2ijuEpr.exe	Get hash	malicious	Babuk, Conti	Browse
	zed.exe	Get hash	malicious	Unknown	Browse
	back.ps1	Get hash	malicious	Unknown	Browse
	zed.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, LummaC Stealer, Nymaim, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.640339306680604
Encrypted:	false
SSDEEP:	192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
MD5:	BCD8CAAF9342AB891BB1D8DD45EF0098
SHA1:	EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
SHA-256:	78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
SHA-512:	8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: lz4wnSavmK.exe, Detection: malicious, Browse Filename: WVuXCNNYG0.exe, Detection: malicious, Browse Filename: dipwo1iToJ.exe, Detection: malicious, Browse Filename: ROh2ijuEpr.exe, Detection: malicious, Browse Filename: zed.exe, Detection: malicious, Browse Filename: back.ps1, Detection: malicious, Browse Filename: zed.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.0194545642425075
Encrypted:	false
SSDEEP:	192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
MD5:	F19CB847E567A31FAB97435536C7B783
SHA1:	4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
SHA-256:	1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
SHA-512:	382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.037456384995606
Encrypted:	false
SSDEEP:	192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
MD5:	DC14677EA8A8C933CC41F9CCF2BEDDC1
SHA1:	A6FB87E8F3540743097A467ABE0723247FDAF469
SHA-256:	68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
SHA-512:	3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.09191874780435
Encrypted:	false
SSDEEP:	192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
MD5:	C09BB8A30F0F733C81C5C5A3DAD8D76D
SHA1:	46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
SHA-256:	8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
SHA-512:	691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.541423493519083
Encrypted:	false
SSDEEP:	384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
MD5:	0AB25F99CDAACA6B11F2ECBE8223CAD5
SHA1:	7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
SHA-256:	6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
SHA-512:	11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.367749645917753
Encrypted:	false
SSDEEP:	192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
MD5:	B6EA675C3A35CD6400A7ECF2FB9530D1
SHA1:	0E41751AA48108D7924B0A70A86031DDE799D7D6
SHA-256:	76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
SHA-512:	E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.41148259289073
Encrypted:	false
SSDEEP:	192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
MD5:	F14E1AA2590D621BE8C10321B2C43132
SHA1:	FD84D11619DFFDF82C563E45B48F82099D9E3130
SHA-256:	FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
SHA-512:	A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.041302713678401
Encrypted:	false
SSDEEP:	384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
MD5:	B127CAE435AEB8A2A37D2A1BC1C27282
SHA1:	2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
SHA-256:	538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
SHA-512:	4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.530656045206549
Encrypted:	false
SSDEEP:	384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
MD5:	2E15AA6F97ED618A3236CFA920988142
SHA1:	A9D556D54519D3E91FA19A936ED291A33C0D1141
SHA-256:	516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
SHA-512:	A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7080156150187396
Encrypted:	false
SSDEEP:	192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
MD5:	40390F2113DC2A9D6CFAE7127F6BA329
SHA1:	9C886C33A20B3F76B37AA9B10A6954F3C8981772
SHA-256:	6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
SHA-512:	617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.159963979391524
Encrypted:	false
SSDEEP:	192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
MD5:	899895C0ED6830C4C9A3328CC7DF95B6
SHA1:	C02F14EBDA8B631195068266BA20E03210ABEABC
SHA-256:	18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
SHA-512:	0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.270418334522813
Encrypted:	false
SSDEEP:	192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
MD5:	C4C525B081F8A0927091178F5F2EE103
SHA1:	A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
SHA-256:	4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
SHA-512:	7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	4.231032526864278
Encrypted:	false
SSDEEP:	384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
MD5:	F9E266F763175B8F6FD4154275F8E2F0
SHA1:	8BE457700D58356BC2FA7390940611709A0E5473
SHA-256:	14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
SHA-512:	EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.252429732285762
Encrypted:	false
SSDEEP:	384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
MD5:	DECF524B2D53FCD7D4FA726F00B3E5FC
SHA1:	E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
SHA-256:	58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
SHA-512:	EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.690163963718492
Encrypted:	false
SSDEEP:	192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
MD5:	80BB1E0E06ACAF03A0B1D4EF30D14BE7
SHA1:	B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
SHA-256:	5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
SHA-512:	2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.1215844022564285
Encrypted:	false
SSDEEP:	384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
MD5:	3727271FE04ECB6D5E49E936095E95BC
SHA1:	46182698689A849A8C210A8BF571D5F574C6F5B1
SHA-256:	3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
SHA-512:	5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.293810509074883
Encrypted:	false
SSDEEP:	384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
MD5:	78AEF441C9152A17DD4DC40C7CC9DF69
SHA1:	6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
SHA-256:	56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
SHA-512:	27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.862619033406922
Encrypted:	false
SSDEEP:	96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
MD5:	19E0ABF76B274C12FF624A16713F4999
SHA1:	A4B370F556B925F7126BF87F70263D1705C3A0DB
SHA-256:	D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
SHA-512:	D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.227045547076371
Encrypted:	false
SSDEEP:	192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
MD5:	309D6F6B0DD022EBD9214F445CAC7BB9
SHA1:	ABD22690B7AD77782CFC0D2393D0C038E16070B0
SHA-256:	4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
SHA-512:	D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.176369829782773
Encrypted:	false
SSDEEP:	192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
MD5:	D54FEB9A270B212B0CCB1937C660678A
SHA1:	224259E5B684C7AC8D79464E51503D302390C5C9
SHA-256:	032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
SHA-512:	29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.047563322651927
Encrypted:	false
SSDEEP:	384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
MD5:	52DCD4151A9177CF685BE4DF48EA9606
SHA1:	F444A4A5CBAE9422B408420115F0D3FF973C9705
SHA-256:	D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
SHA-512:	64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.09893680790018
Encrypted:	false
SSDEEP:	192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
MD5:	F929B1A3997427191E07CF52AC883054
SHA1:	C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
SHA-256:	5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
SHA-512:	2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.451865349855574
Encrypted:	false
SSDEEP:	384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
MD5:	1FA5E257A85D16E916E9C22984412871
SHA1:	1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
SHA-256:	D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
SHA-512:	E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.104245335186531
Encrypted:	false
SSDEEP:	192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
MD5:	FAD578A026F280C1AE6F787B1FA30129
SHA1:	9A3E93818A104314E172A304C3D117B6A66BEB55
SHA-256:	74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
SHA-512:	ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.671305741258107
Encrypted:	false
SSDEEP:	384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
MD5:	556E6D0E5F8E4DA74C2780481105D543
SHA1:	7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
SHA-256:	247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
SHA-512:	28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h..9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ...............P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.878701941774916
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
MD5:	2F2655A7BBFE08D43013EDDA27E77904
SHA1:	33D51B6C423E094BE3E34E5621E175329A0C0914
SHA-256:	C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
SHA-512:	8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.881781476285865
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
MD5:	CDE035B8AB3D046B1CE37EEE7EE91FA0
SHA1:	4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
SHA-256:	16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
SHA-512:	C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.837887867708438
Encrypted:	false
SSDEEP:	768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
MD5:	999D431197D7E06A30E0810F1F910B9A
SHA1:	9BFF781221BCFFD8E55485A08627EC2A37363C96
SHA-256:	AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
SHA-512:	A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.895310340516013
Encrypted:	false
SSDEEP:	768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
MD5:	0931ABBF3AED459B1A2138B551B1D3BB
SHA1:	9EC0296DDAF574A89766A2EC035FC30073863AB0
SHA-256:	1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
SHA-512:	9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.967737129255606
Encrypted:	false
SSDEEP:	192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
MD5:	5F057A380BACBA4EF59C0611549C0E02
SHA1:	4B758D18372D71F0AA38075F073722A55B897F71
SHA-256:	BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
SHA-512:	E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.007867576025166
Encrypted:	false
SSDEEP:	192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
MD5:	49BCA1B7DF076D1A550EE1B7ED3BD997
SHA1:	47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
SHA-256:	49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
SHA-512:	8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.226023387740053
Encrypted:	false
SSDEEP:	384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
MD5:	CB5CFDD4241060E99118DEEC6C931CCC
SHA1:	1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
SHA-256:	A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
SHA-512:	8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.262055670423592
Encrypted:	false
SSDEEP:	192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
MD5:	18D2D96980802189B23893820714DA90
SHA1:	5DEE494D25EB79038CBC2803163E2EF69E68274C
SHA-256:	C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
SHA-512:	0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..\|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..\|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.913843738203007
Encrypted:	false
SSDEEP:	384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
MD5:	EF472BA63FD22922CA704B1E7B95A29E
SHA1:	700B68E7EF95514D5E94D3C6B10884E1E187ACD8
SHA-256:	66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
SHA-512:	DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..\|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.735350805948923
Encrypted:	false
SSDEEP:	192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
MD5:	3B1CE70B0193B02C437678F13A335932
SHA1:	063BFD5A32441ED883409AAD17285CE405977D1F
SHA-256:	EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
SHA-512:	0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_curve25519.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.705606408072877
Encrypted:	false
SSDEEP:	384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
MD5:	FF33C306434DEC51D39C7BF1663E25DA
SHA1:	665FCF47501F1481534597C1EAC2A52886EF0526
SHA-256:	D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
SHA-512:	66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_curve448.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.0189903352673655
Encrypted:	false
SSDEEP:	1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
MD5:	F267BF4256F4105DAD0D3E59023011ED
SHA1:	9BC6CA0F375CE49D5787C909D290C07302F58DA6
SHA-256:	1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
SHA-512:	A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	7.613224993327352
Encrypted:	false
SSDEEP:	12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
MD5:	1EFD7F7CB1C277416011DE6F09C355AF
SHA1:	C0F97652AC2703C325AB9F20826A6F84C63532F2
SHA-256:	AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
SHA-512:	2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.8551858881598795
Encrypted:	false
SSDEEP:	384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
MD5:	C5FB377F736ED731B5578F57BB765F7A
SHA1:	5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
SHA-256:	32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
SHA-512:	D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.064677498000638
Encrypted:	false
SSDEEP:	1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
MD5:	8A0C0AA820E98E83AC9B665A9FD19EAF
SHA1:	6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
SHA-256:	4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
SHA-512:	52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.675380950473425
Encrypted:	false
SSDEEP:	96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
MD5:	44B930B89CE905DB4716A548C3DB8DEE
SHA1:	948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
SHA-256:	921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
SHA-512:	79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..\|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.625428549874022
Encrypted:	false
SSDEEP:	96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
MD5:	F24F9356A6BDD29B9EF67509A8BC3A96
SHA1:	A26946E938304B4E993872C6721EB8CC1DCBE43B
SHA-256:	034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
SHA-512:	C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.641929675972235
Encrypted:	false
SSDEEP:	1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5:	4585A96CC4EEF6AAFD5E27EA09147DC6
SHA1:	489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
SHA-256:	A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
SHA-512:	D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71448
Entropy (8bit):	6.243013214204417
Encrypted:	false
SSDEEP:	1536:nhaPPkvDcBlqCTFFQ/ObfW11swNIGOnL7SyaeCxT:hanCDcnqCJFOObfW11swNIGOnLoeE
MD5:	2CD68FF636394D3019411611E27D0A3B
SHA1:	DA369C5D1A32F68639170D8A265A9EA49C2C8EBD
SHA-256:	0D4FBD46F922E548060EA74C95E99DC5F19B1DF69BE17706806760515C1C64FE
SHA-512:	37388D137454F52057B2376D95ABCC955FA1EDC3E20B96445FA45D1860544E811DF0C547F221C8671DC1A4D90262BB20F3B9F114252F3C47A8C3829951A2CE51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:.T.[...[...[...#*..[...'...[...'...[...'...[...'...[...&...[..M#...[...[...[...&...[...&...[...&F..[...&...[..Rich.[..........................PE..d...Q..e.........." ...#.f................................................... ......A&....`.............................................P......d......................../..............T...........................@...@............................................text...)d.......f.................. ..`.rdata..`O.......P...j..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84760
Entropy (8bit):	6.584507188180646
Encrypted:	false
SSDEEP:	1536:FFzZz757cav+IuK66nlxX8W8LsANVIGCV87SyixL7:DzZzq6n3MhLsMVIGCV8O7
MD5:	C7CE973F261F698E3DB148CCAD057C96
SHA1:	59809FD48E8597A73211C5DF64C7292C5D120A10
SHA-256:	02D772C03704FE243C8DE2672C210A5804D075C1F75E738D6130A173D08DFCDE
SHA-512:	A924750B1825747A622EEF93331FD764D824C954297E37E8DC93A450C11AA7AB3AD7C3B823B11656B86E64DE3CD5D409FDA15DB472488DFAA4BB50341F0B29D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w.l.3...3...3...:...9......1......0......>......;......7.......0...x...1...3...l.......;.......2.......2.......2...Rich3...................PE..d...f..e.........." ...#.....^...............................................P.......@....`.............................................H............0....... ..,......../...@..........T...........................p...@............................................text............................... ..`.rdata..p>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_cffi_backend.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179712
Entropy (8bit):	6.180800197956408
Encrypted:	false
SSDEEP:	3072:IULjhBCx8qImKrUltSfGzdMcbb9CF8OS7jkSTLkKWlgeml:IgCeqImzSfIMcNCvOkSTLLWWem
MD5:	FCB71CE882F99EC085D5875E1228BDC1
SHA1:	763D9AFA909C15FEA8E016D321F32856EC722094
SHA-256:	86F136553BA301C70E7BADA8416B77EB4A07F76CCB02F7D73C2999A38FA5FA5B
SHA-512:	4A0E98AB450453FD930EDC04F0F30976ABB9214B693DB4B6742D784247FB062C57FAFAFB51EB04B7B4230039AB3B07D2FFD3454D6E261811F34749F2E35F04D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......a..#%p.p%p.p%p.p,..p)p.p5.q'p.p5.zp!p.p5.q!p.p5.q-p.p5.q)p.pn..q!p.p6.q&p.p%p.p.p.pm..q!p.p,..p$p.pm..q$p.pm.xp$p.pm..q$p.pRich%p.p........................PE..d...W..f.........." ...).....B......`........................................0............`..........................................h..l....i..................T............ .......O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...p..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124696
Entropy (8bit):	6.1345016966871455
Encrypted:	false
SSDEEP:	3072:kuiS11BYNd+5AWdu41qOqJ/f/EX4lCPIWu1ptpIGLP+z:Pl1U+Ke/16f/ExWI
MD5:	10FDCF63D1C3C3B7E5861FBB04D64557
SHA1:	1AA153EFEC4F583643046618B60E495B6E03B3D7
SHA-256:	BC3B83D2DC9E2F0E6386ED952384C6CF48F6EED51129A50DFD5EF6CBBC0A8FB3
SHA-512:	DC702F4100ED835E198507CD06FA5389A063D4600FC08BE780690D729AB62114FD5E5B201D511B5832C14E90A5975ED574FC96EDB5A9AB9EB83F607C7A712C7F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...z.z.z.s...\|....x....v....r....~.....x.1...{.1...\|.....y.z.......\|.....{...o.{.....{.Richz.................PE..d...c..e.........." ...#............p^..............................................".....`..........................................`.......a.........................../......p.......T...............................@............................................text............................... ..`.rdata...l.......n..................@..@.data....4.......0...h..............@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	253208
Entropy (8bit):	6.567915765795386
Encrypted:	false
SSDEEP:	6144:DV0lmIvcruIDCiryrjqPBTn9qWM53pLW1AuDRRRctULoT3TdTx:SN0rQiryr8TaV+QTdTx
MD5:	21C73E7E0D7DAD7A1FE728E3B80CE073
SHA1:	7B363AF01E83C05D0EA75299B39C31D948BBFE01
SHA-256:	A28C543976AA4B6D37DA6F94A280D72124B429F458D0D57B7DBCF71B4BEA8F73
SHA-512:	0357102BFFC2EC2BC6FF4D9956D6B8E77ED8558402609E558F1C1EBC1BACA6AEAA5220A7781A69B783A54F3E76362D1F74D817E4EE22AAC16C7F8C86B6122390
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.R.!...!...!...Y=..!..+]...!..+]...!..+]...!..+]...!..M\...!...Y...!...!...!..M\...!..M\...!..M\...!..M\Q..!..M\...!..Rich.!..........PE..d...T..e.........." ...#.v...<......\|.....................................................`..........................................T..P....T...................'......./......P...`...T........................... ...@............................................text....t.......v.................. ..`.rdata...............z..............@..@.data....*...p...$...R..............@....pdata...'.......(...v..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64792
Entropy (8bit):	6.219813461442214
Encrypted:	false
SSDEEP:	1536:CQGllrIdcGuzZc94cVM7gDX4NIGOI67Sy+xzn1:I6cvz+9IgDX4NIGOI6Sn1
MD5:	F495D1897A1B52A2B15C20DCECB84B47
SHA1:	8CB65590A8815BDA58C86613B6386B5982D9EC3F
SHA-256:	E47E76D70D508B62924FE480F30E615B12FDD7745C0AAC68A2CDDABD07B692AE
SHA-512:	725D408892887BEBD5BCF040A0ECC6A4E4B608815B9DEA5B6F7B95C812715F82079896DF33B0830C9F787FFE149B8182E529BB1F78AADD89DF264CF8853EE4C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........u...&...&...&.U&...&u..'...&u..'...&u..'...&u..'...&...'...&...'...&...&M..&...'...&...'...&..9&...&...'...&Rich...&........PE..d......e.........." ...#.R...~.......>..............................................'.....`.............................................P.............................../......X....\|..T............................{..@............p..(............................text...7P.......R.................. ..`.rdata...N...p...P...V..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159512
Entropy (8bit):	6.841828996170163
Encrypted:	false
SSDEEP:	3072:RmuEE9tZBoI+1hINrznfB9mNoNSn2Vh/VDxuVIGZ1L6E:RmuFPobkNpYONnvfuCE
MD5:	4E2239ECE266230ECB231B306ADDE070
SHA1:	E807A078B71C660DB10A27315E761872FFD01443
SHA-256:	34130D8ABE27586EE315262D69AF4E27429B7EAB1F3131EA375C2BB62CF094BE
SHA-512:	86E6A1EAB3529E600DD5CAAB6103E34B0F618D67322A5ECF1B80839FAA028150C492A5CF865A2292CC8584FBA008955DA81A50B92301583424401D249C5F1401
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........TB#.5,p.5,p.5,p.M.p.5,p.I-q.5,p.I)q.5,p.I(q.5,p.I/q.5,pnH-q.5,p.M-q.5,p.5-p.5,pnH!q.5,pnH,q.5,pnH.p.5,pnH.q.5,pRich.5,p........PE..d......e.........." ...#.d..........06....................................................`......................................... %..L...l%..x....p.......P.......@.../......4.......T...........................p...@............................................text...:b.......d.................. ..`.rdata..............h..............@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35096
Entropy (8bit):	6.456173627081832
Encrypted:	false
SSDEEP:	768:VAIvrenSE0PkA9c0ji+m9IGWte5YiSyv2pAAMxkEn:6ITQSH9c0jlm9IGWtU7SyOOxj
MD5:	811BCEE2F4246265898167B103FC699B
SHA1:	AE3DE8ACBA56CDE71001D3796A48730E1B9C7CCE
SHA-256:	FB69005B972DC3703F9EF42E8E0FDDF8C835CB91F57EF9B6C66BBDF978C00A8C
SHA-512:	1F71E23CE4B6BC35FE772542D7845DCBEA2A34522BA0468B61CB05F9ABAB7732CBF524BCFF498D1BD0B13B5E8A45C373CCA19AD20E5370F17259E281EDF344BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........)*.wGy.wGy.wGy...y.wGy'.Fx.wGy'.Bx.wGy'.Cx.wGy'.Dx.wGyA.Fx.wGy.wFy.wGy..Fx.wGyA.Jx.wGyA.Gx.wGyA..y.wGyA.Ex.wGyRich.wGy........................PE..d...W..e.........." ...#.....>......P.....................................................`.........................................0E..`....E..x............p.......Z.../...........4..T............................3..@............0...............................text............................... ..`.rdata..r ...0..."..."..............@..@.data........`.......D..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55576
Entropy (8bit):	6.3454178187323755
Encrypted:	false
SSDEEP:	1536:2ND3ua5sIRL9EiqXxpNdtrtBIGXtz7SyNxM:2NjOiUpNdPBIGXtzi
MD5:	F9C67280538408411BE9A7341B93B5B0
SHA1:	CCF776CD2483BC83B48B1DB322D7B6FCAB48356E
SHA-256:	5D298BB811037B583CFF6C88531F1742FAE5EEE47C290ADB47DDBD0D6126B9CC
SHA-512:	AF2156738893EF504D582ACE6750B25BC42AD1EC8A92E0550CE54810706D854F37A82F38EB965A537CAD5D35C0178C5EB7B4D20DB2A95BEBFECF9A13C0592646
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|!{X.O(X.O(X.O(Qe.(\.O(.aN)Z.O(.aJ)T.O(.aK)P.O(.aL)[.O(.`N)Z.O(X.N(/.O(.eN)].O(.eK)Y.O(.`B)Y.O(.`O)Y.O(.`.(Y.O(.`M)Y.O(RichX.O(................PE..d...V..e.........." ...#.L...`......P...............................................wC....`.............................................X...X............................/......(....f..T...........................`e..@............`...............................text....J.......L.................. ..`.rdata..D8...`...:...P..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.464181935983508
Encrypted:	false
SSDEEP:	768:/k+Ea6rfMkAYY0J/MpIGQUG5YiSyvHAMxkEJ5YSv:8tfHY0JEpIGQU87SyPx/Y+
MD5:	6E00E0821BB519333CCFD4E61A83CB38
SHA1:	3550A41BB2EA54F456940C4D1940ACAB36815949
SHA-256:	2AD02D49691A629F038F48FCDEE46A07C4FCC2CB0620086E7B09AC11915AE6B7
SHA-512:	C3F8332C10B58F30E292676B48ECF1860C5EF9546367B87E90789F960C91EAE4D462DD3EE9CB14F603B9086E81B6701AAB56DA5B635B22DB1E758ED0A983E562
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B:W\.[9..[9..[9..#...[9..'8..[9..'<..[9..'=..[9..':..[9..&8..[9.M#8..[9..[8.M[9..&4..[9..&9..[9..&...[9..&;..[9.Rich.[9.........................PE..d...Y..e.........." ...#.....8.......................................................a....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83224
Entropy (8bit):	6.340320871656589
Encrypted:	false
SSDEEP:	1536:ZUuhzLx79flWrqcqtpjly+uCo9/s+S+pzcHQ6B48/VI9dsSbxntpIGLwIU7SyZxL:ZU6zLRNawRy+uCo9/sT+pzuXxVIbsSde
MD5:	899380B2D48DF53414B974E11BB711E3
SHA1:	F1D11F7E970A7CD476E739243F8F197FCB3AD590
SHA-256:	B38E66E6EE413E5955EF03D619CADD40FCA8BE035B43093D2342B6F3739E883E
SHA-512:	7426CA5E7A404B9628E2966DAE544F3E8310C697145567B361825DC0B5C6CD87F2CAF567DEF8CD19E73D68643F2F38C08FF4FF0BB0A459C853F241B8FDF40024
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J./.+z\|.+z\|.+z\|.S.\|.+z\|.W{}.+z\|.W.}.+z\|.W~}.+z\|.Wy}.+z\|}V{}.+z\|.+{\|.+z\|.S{}.+z\|}Vw}.+z\|}Vz}.+z\|}V.\|.+z\|}Vx}.+z\|Rich.+z\|................PE..d......e.........." ...#.v...........-.......................................`...........`.............................................P............@.......0.........../...P..........T...............................@............................................text....u.......v.................. ..`.rdata...x.......z...z..............@..@.data...H...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124696
Entropy (8bit):	6.2652662506859444
Encrypted:	false
SSDEEP:	3072:fZIPlR6TxhNO7/9CO4w5yIFGcXcpVNIGOQyl:RjFHO7kC56cXuo
MD5:	CEE93C920951C1169B615CB6330CEDDA
SHA1:	EF2ABF9F760DB2DE0BD92AFE8766A0B798CF8167
SHA-256:	FF25BDBEEF34D2AA420A79D3666C2660E7E3E96259D1F450F1AF5268553380EC
SHA-512:	999D324448BB39793E4807432C697F01F8922B0ABA4519A21D5DC4F4FC8E9E4737D7E104B205B931AF753EDA65F61D0C744F12BE84446F9C6CB3C2A5B35B773C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@.g...g...g.......g..../..g......g....+..g....*..g....-..g..q./..g..../..g...g/..f..q.#..g..q....g..q...g..q.,..g..Rich.g..........PE..d......e.........." ...#.............................................................-....`.........................................po..P....o..................8......../.......... ...T...............................@............................................text............................... ..`.rdata..............................@..@.data...8............\|..............@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177432
Entropy (8bit):	5.975354635226847
Encrypted:	false
SSDEEP:	3072:KXGEr/16/nJxNOJW5NT6X3l44K5WOSCSVRJNI7IM/cbP7RHs3J7VIGC7hN:Y/r/16/nDNPT6X3l1CMVS7i
MD5:	9B4E74FD1DE0F8A197E4AA1E16749186
SHA1:	833179B49EB27C9474B5189F59ED7ECF0E6DC9EA
SHA-256:	A4CE52A9E0DADDBBE7A539D1A7EDA787494F2173DDCC92A3FAF43B7CF597452B
SHA-512:	AE72B39CB47A859D07A1EE3E73DE655678FE809C5C17FFD90797B5985924DDB47CEB5EBE896E50216FB445526C4CBB95E276E5F3810035B50E4604363EB61CD4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U.k.4.8.4.8.4.8.L)8.4.8.H.9.4.8.H.9.4.8.H.9.4.8.H.9.4.8kI.9.4.8.4.8#5.8.L.9.4.8kI.9.4.8kI.9.4.8kIE8.4.8kI.9.4.8Rich.4.8........................PE..d......e.........." ...#............\,....................................................`......................................... ...d.......................8......../......x...@...T...............................@............................................text.............................. ..`.rdata...!......."..................@..@.data...(...........................@....pdata..8............^..............@..@.rsrc................j..............@..@.reloc..x............t..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25368
Entropy (8bit):	6.6272949891352315
Encrypted:	false
SSDEEP:	384:lrfwHnEWGQiAQVIGZwJXHQIYiSy1pCQ4XAM+o/8E9VF0NyqzJSj:dQnEIHQVIGZw95YiSyv8AMxkEqw
MD5:	3C8737723A903B08D5D718336900FD8C
SHA1:	2AD2D0D50F6B52291E59503222B665B1823B0838
SHA-256:	BB418E91E543C998D11F9E65FD2A4899B09407FF386E059A88FE2A16AED2556B
SHA-512:	1D974EC1C96E884F30F4925CC9A03FB5AF78687A267DEC0D1582B5D7561D251FB733CF733E0CC00FAEE86F0FEF6F73D36A348F3461C6D34B0238A75F69320D10
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<p.R#.R#.R#...#.R#i.S".R#i.W".R#i.V".R#i.Q".R#..S".R#..S".R#.S#..R#..Z".R#..R".R#...#.R#..P".R#Rich.R#........................PE..d...]..e.........." ...#.....&...... ........................................p......wz....`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36632
Entropy (8bit):	6.364173312940401
Encrypted:	false
SSDEEP:	768:PgMwnWGwMtUTA7LlVIGCilx5YiSyvzAMxkEaFy:PgMwWGJtGA7LlVIGCih7Syrx+g
MD5:	EE33F4C8D17D17AD62925E85097B0109
SHA1:	8C4A03531CF3DBFE6F378FDAB9699D51E7888796
SHA-256:	79ADCA5037D9145309D3BD19F7A26F7BB7DA716EE86E01073C6F2A9681E33DAD
SHA-512:	60B0705A371AD2985DB54A91F0E904EEA502108663EA3C3FB18ED54671BE1932F4F03E8E3FD687A857A5E3500545377B036276C69E821A7D6116B327F5B3D5C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._\...=.@.=.@.=.@.En@.=.@.A.A.=.@.A.A.=.@.A.A.=.@.@.A.=.@.A.A.=.@PE.A.=.@.=.@A=.@PE.A.=.@.@.A.=.@.@.A.=.@.@.@.=.@.@.A.=.@Rich.=.@........PE..d..._..e.........." ...#.(...:.......&....................................................`..........................................T..H....T...............p..`....`.../......t...DG..T............................C..@............@.......S..@....................text...>&.......(.................. ..`.rdata..D....@... ...,..............@..@.data........`.......L..............@....pdata..`....p.......P..............@..@.rsrc................T..............@..@.reloc..t............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\base_library.zip

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1329520
Entropy (8bit):	5.586658826960449
Encrypted:	false
SSDEEP:	12288:uttcY+b+2OGgRF1+fYNXPh26UZWAzau7joD9VwdgbVDdYeP1whshZgCCaYchi:uttcY+PnCiaAoDNBDdYePyqEaYchi
MD5:	C4DCF6023D754DAA9A41D6D2DA6842CA
SHA1:	2B1ACA3FFEBDE36FA31AB9A14A709C7C6C125773
SHA-256:	3C472B0FDFBFEB7721FAC540BF55EEC190EDF5AEA6C370A4C3BFF87F88077A97
SHA-512:	55A9E82B36AADD29AC22811EE295E75FC9EA12912DD6C498AB808A6DC83BE4FAB40ECA2BCCB991D593180E2162A456903479810E7B31B848ACD363DEFB15726D
Malicious:	false
Preview:	PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI45762\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer\md.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.817893239381772
Encrypted:	false
SSDEEP:	192:MRv9XFCk2z1/t12iwU5usJFcCyD9cqgE:aVVC5djuUFJKtgE
MD5:	71D96F1DBFCD6F767D81F8254E572751
SHA1:	E70B74430500ED5117547E0CD339D6E6F4613503
SHA-256:	611E1B4B9ED6788640F550771744D83E404432830BB8E3063F0B8EC3B98911AF
SHA-512:	7B10E13B3723DB0E826B7C7A52090DE999626D5FA6C8F9B4630FDEEF515A58C40660FA90589532A6D4377F003B3CB5B9851E276A0B3C83B9709E28E6A66A1D32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d... $.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	5.935676608756784
Encrypted:	false
SSDEEP:	1536:BETt3OiaqGB7QNX6Pq4a461TDqFRgMzrOH+d3gdy2iIeP/j3bhouROm:Bmt+is7QNqP1ab1TGb9g/iI4bhouROm
MD5:	D8F690EAE02332A6898E9C8B983C56DD
SHA1:	112C1FE25E0D948F767E02F291801C0E4AE592F0
SHA-256:	C6BB8CAD80B8D7847C52931F11D73BA64F78615218398B2C058F9B218FF21CA9
SHA-512:	E732F79F39BA9721CC59DBE8C4785FFD74DF84CA00D13D72AFA3F96B97B8C7ADF4EA9344D79EE2A1C77D58EF28D3DDCC855F3CB13EDDA928C17B1158ABCC5B4A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........yB....................7...............7.......7.......7.......6..........C....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........B.......................................0............`.............................................d.................................... ......@...................................@............P...............................text....>.......@.................. ..`.rdata..PY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5724
Entropy (8bit):	5.120429897887076
Encrypted:	false
SSDEEP:	96:DlkQIUQIhQIKQILbQIRIaMPktjaVMxsxA2ncEvGDfe0HEdwGArNZG0JQTQCQx5Kw:dcPuPwsrcEvGDfe0HENA5w0JQTQ9x59H
MD5:	526D9AC9D8150602EC9ED8B9F4DE7102
SHA1:	DBA2CB32C21C4B0F575E77BBCDD4FA468056F5E3
SHA-256:	D95F491ED418DC302DB03804DAF9335CE21B2DF4704587E6851EF03E1F84D895
SHA-512:	FB13A2F6B64CB7E380A69424D484FC9B8758FA316A7A155FF062BFDACDCA8F2C5D2A03898CD099688B1C16A5A0EDCECFC42BF0D4D330926B10C3FCE9F5238643
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 44.0.0.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	16380
Entropy (8bit):	5.587009861664839
Encrypted:	false
SSDEEP:	192:hXr12s/l45jEVeK+VqhXJZ4WJJ6sf7B0PpzIq+NX6ih5VFUqq8q:hXplMEVdhJrJJ6sf7B0Ppz/+96ihu8q
MD5:	A53742D3EE69CAE1FD8BDEDAC05BB828
SHA1:	02BC360839FEB54E58E14D410266652DCB718353
SHA-256:	9518E7D9DA0F889F568F800E1A4ADC0686234DC9D9934A46F78FFB5E6C351A98
SHA-512:	C69C4D3ECA56D725E90F9F0C4B98071F4F92A3BC06A635CE0D6309976C750B20B3DA353EFED27F07712FF5E0C1A8114300004C8E2D2EE9155F31D856A3C6EE05
Malicious:	false
Preview:	cryptography-44.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-44.0.0.dist-info/METADATA,sha256=2V9JHtQY3DAtsDgE2vkzXOIbLfRwRYfmhR7wPh-E2JU,5724..cryptography-44.0.0.dist-info/RECORD,,..cryptography-44.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-44.0.0.dist-info/WHEEL,sha256=Hn9bytZpOGoR6M4U5xUTHC1AJpPD9B1xPrM4STxljEU,94..cryptography-44.0.0.dist-info/licenses/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-44.0.0.dist-info/licenses/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-44.0.0.dist-info/licenses/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=fcUqF1IcadxBSH0us1vCvob0OJOrPV3h30yZD8wsHo4,445..cryptography/__init__.py,sha256=XsRL_PxbU6UgoyoglAgJQSrJCP97ovBA8YIEQ2-uI68,762..cryptography/__pycache__/__about__.cpython-312.pyc,,..cryptography/__pycache__/__init__.cpython-312

C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.0373614967294325
Encrypted:	false
SSDEEP:	3:RtEeX5pG6vhP+tkKciH/KQb:RtvoKWKTQb
MD5:	A868F93FCF51C4F1C25658D54F994349
SHA1:	535C88A10911673DEABB7889D365E81729E483A6
SHA-256:	1E7F5BCAD669386A11E8CE14E715131C2D402693C3F41D713EB338493C658C45
SHA-512:	EC13CAC9DF03676640EF5DA033E8C2FAEE63916F27CC27B9C43F0824B98AB4A6ECB4C8D7D039FA6674EF189BDD9265C8ED509C1D80DFF610AEB9E081093AEB3D
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.5).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info\licenses\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography-44.0.0.dist-info\licenses\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI45762\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8292864
Entropy (8bit):	6.493076254122072
Encrypted:	false
SSDEEP:	98304:Y4sf3zg+qUuQdPJMqYLSxuBLZqwt0kDO+5+O:cdeqYLSxuBLZrGjq+
MD5:	34293B976DA366D83C12D8EE05DE7B03
SHA1:	82B8EB434C26FCC3A5D9673C9B93663C0FF9BF15
SHA-256:	A2285C3F2F7E63BA8A17AB5D0A302740E6ADF7E608E0707A7737C1EC3BD8CECC
SHA-512:	0807EC7515186F0A989BB667150A84FF3BEBCC248625597BA0BE3C6F07AD60D70CF8A3F65191436EC16042F446D4248BF92FCD02212E459405948DB10F078B8E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.j...j...j....F..j.......j.......j.......j.......j.......j.......j...j...h.......i...j...j.......j.......j..Rich.j..........................PE..d....^Gg.........." ...*.R\..n"......~Z.......................................~...........`...........................................x.X.....x...............y...............~.......o.T.....................o.(...p.o.@............p\.8............................text....Q\......R\................. ..`.rdata..P9...p\..:...V\.............@..@.data... >....x.......x.............@....pdata........y.......y.............@..@.reloc........~.......}.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5162776
Entropy (8bit):	5.958207976652471
Encrypted:	false
SSDEEP:	98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
MD5:	51E8A5281C2092E45D8C97FBDBF39560
SHA1:	C499C810ED83AAADCE3B267807E593EC6B121211
SHA-256:	2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
SHA-512:	98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.\|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...\|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	790296
Entropy (8bit):	5.607732992846443
Encrypted:	false
SSDEEP:	6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
MD5:	BFC834BB2310DDF01BE9AD9CFF7C2A41
SHA1:	FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
SHA-256:	41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
SHA-512:	6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	200472
Entropy (8bit):	6.382659996286758
Encrypted:	false
SSDEEP:	3072:mhaQEuYCUDWuc7VmkqrgVrLJEKAAKJadAT0nIgjWdopPb/+mVApIGLhSZ:yaJh6v7VRVrLJEKAABiuXKd4GE
MD5:	F554064233C082F98EF01195693D967D
SHA1:	F191D42807867E0174DDC66D04C45250D9F6561E
SHA-256:	E1D56FFBF5E5FAB481D7A14691481B8FF5D2F4C6BF5D1A4664C832756C5942FE
SHA-512:	3573A226305CEC45333FC4D0E6FC0C3357421AD77CD8A1899C90515994351292EE5D1C445412B5563AA02520736E870A9EE879909CD992F5BE32E877792BDB88
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................g.................................h.......................h.......h.......h.......h.......Rich....................PE..d...Z..e.........." ...#............0...............................................2.....`.............................................P...`............................/..........P4..T............................3..@............ ...............................text.../........................... ..`.rdata..4.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\python3.dll

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68376
Entropy (8bit):	6.14883904573939
Encrypted:	false
SSDEEP:	768:3V1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/J:3DmF61JFn+/OipIGL0m7Sy0xG
MD5:	77896345D4E1C406EEFF011F7A920873
SHA1:	EE8CDD531418CFD05C1A6792382D895AC347216F
SHA-256:	1E9224BA7190B6301EF47BEFA8E383D0C55700255D04A36F7DAC88EA9573F2FB
SHA-512:	3E98B1B605D70244B42A13A219F9E124944DA199A88AD4302308C801685B0C45A037A76DED319D08DBF55639591404665BEFE2091F0F4206A9472FEE58D55C22
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."e.."e.."e.0_m.."e.0_e.."e.0_..."e.0_g.."e.Rich."e.................PE..d...@..e.........." ...#............................................................q.....`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\python312.dll

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6972184
Entropy (8bit):	5.774196030396665
Encrypted:	false
SSDEEP:	98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
MD5:	5C5602CDA7AB8418420F223366FFF5DB
SHA1:	52F81EE0AEF9B6906F7751FD2BBD4953E3F3B798
SHA-256:	E7890E38256F04EE0B55AC5276BBF3AC61392C3A3CE150BB5497B709803E17CE
SHA-512:	51C3B4F29781BB52C137DDB356E1BC5A37F3A25F0ED7D89416B14ED994121F884CB3E40CCDBB211A8989E3BD137B8DF8B28E232F98DE8F35B03965CFCE4B424F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................m.................x...s...x......x......x......Rich............PE..d...=..e.........." ...#..(..6B.....l........................................@k.......k...`......................................... .O.......O.......i......``..V...4j../....i..X.. I3.T....................7I.(....G3.@.............(..............................text...V.(.......(................. ..`.rdata...A'...(..B'...(.............@..@.data....4... P..x....O.............@....pdata...V...``..X...v_.............@..@PyRuntim......b.......a.............@....rsrc.........i.......h.............@..@.reloc...X....i..Z....h.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\select.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31000
Entropy (8bit):	6.531624163477087
Encrypted:	false
SSDEEP:	768:s7ENJKHq1vv38pIGQGE5YiSyvTcAMxkEMrX:s7ENJKK1vv38pIGQGO7Syb6xuX
MD5:	BFFFF83A000BAF559F3EB2B599A1B7E8
SHA1:	7F9238BDA6D0C7CC5399C6B6AB3B42D21053F467
SHA-256:	BC71FBDFD1441D62DD86D33FF41B35DC3CC34875F625D885C58C8DC000064DAB
SHA-512:	3C0BA0CF356A727066AE0D0D6523440A882AAFB3EBDF70117993EFFD61395DEEBF179948F8C7F5222D59D1ED748C71D9D53782E16BD2F2ECCC296F2F8B4FC948
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.q\|'.q\|'.q\|'...'.q\|'q.}&.q\|'q.y&.q\|'q.x&.q\|'q..&.q\|'..}&.q\|'.q}'.q\|'..}&.q\|'..q&.q\|'..\|&.q\|'...'.q\|'..~&.q\|'Rich.q\|'........PE..d...Z..e.........." ...#.....2............................................................`..........................................@..L...,A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text...v........................... ..`.rdata.......0......................@..@.data........P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	5.006900644756252
Encrypted:	false
SSDEEP:	96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
MD5:	98ABEAACC0E0E4FC385DFF67B607071A
SHA1:	E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
SHA-256:	6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
SHA-512:	F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.6307766747793275
Encrypted:	false
SSDEEP:	48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
MD5:	EB513CAFA5226DDA7D54AFDCC9AD8A74
SHA1:	B394C7AEC158350BAF676AE3197BEF4D7158B31C
SHA-256:	0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
SHA-512:	A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
Malicious:	false
Preview:	importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.687870576189661
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
MD5:	7D09837492494019EA51F4E97823D79F
SHA1:	7829B4324BB542799494131A270EC3BDAD4DEDEF
SHA-256:	9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
SHA-512:	A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text, with very long lines (888)
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.226823573023539
Encrypted:	false
SSDEEP:	24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
MD5:	4CE7501F6608F6CE4011D627979E1AE4
SHA1:	78363672264D9CD3F72D5C1D3665E1657B1A5071
SHA-256:	37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
SHA-512:	A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
Malicious:	false
Preview:	Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI45762\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI45762\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1504024
Entropy (8bit):	6.578874733366613
Encrypted:	false
SSDEEP:	24576:95WQyUuqjJVKMXijWRwtHHofIyEcL/2m75i5zxHWc9C08lY8ore60hH:9b0yVKMyjWR6nofQm7U59HWKYY8
MD5:	82EA0259009FF75BBA817BD8C15C7588
SHA1:	04C49687D8241B43AE61A6C59299255EF09A7B39
SHA-256:	8AA8B909A39FCC33D1EC2AD51EAC6714A318C6EFD04F963D21B75D8F64809AD6
SHA-512:	1F8B3343898462E385D25E1820A3D7D971D633933E482EA9FFC596E7E1F902F5657A9F2C104CF320EEEF34CCE814261304E2E1C063BE4C6A807ADC9B75F3E670
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W..W..W..^.P.[....U....Z...._.....S.....T..W........V.....V....<.V......V..RichW..........................PE..d......e.........." ...#..................................................................`.........................................Px...".............................../...........*..T............................(..@...............8............................text............................... ..`.rdata..............................@..@.data...PG.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI45762\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\shost.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1137944
Entropy (8bit):	5.462221778372869
Encrypted:	false
SSDEEP:	12288:IFrEHdcM6hbZCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfctZq:IFrEXcCjfk7bPNfv42BN6yzUtZq
MD5:	A1388676824CE6347D31D6C6A7A1D1B5
SHA1:	27DD45A5C9B7E61BB894F13193212C6D5668085B
SHA-256:	2480A78815F619A631210E577E733C9BAFECB7F608042E979423C5850EE390FF
SHA-512:	26EA1B33F14F08BB91027E0D35AC03F6203B4DFEEE602BB592C5292AB089B27FF6922DA2804A9E8A28E47D4351B32CF93445D894F00B4AD6E2D0C35C6C7F1D89
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w...3m..3m..3m..:...5m......1m......>m......;m......0m......0m..x...1m..3m..cm......2m......2m....j.2m......2m..Rich3m..................PE..d...]..e.........." ...#.>..........`*.......................................p.......%....`.........................................p...X............P.......@.........../...`......P^..T............................]..@............P..p............................text....=.......>.................. ..`.rdata..\....P.......B..............@..@.data...X.... ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.993419130235619
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	shost.exe
File size:	16'895'360 bytes
MD5:	e6c0aa5771a46907706063ae1d8b4fb9
SHA1:	966ce51dfb51cf7e9db0c86eb35b964195c21bf2
SHA256:	b76d1577baac7071b5243e8639007e2cdd406258d6da07386fb0d638988d382f
SHA512:	194beea483af2a2bc844927dbcf6b1ff2e028cc5e10dd93d47917d24cbba551f888b1fa795385f24bbb72efc619f1c28c25e171437fd810fa87de5ef895f313f
SSDEEP:	393216:d9Yid4u1iwq3Obs2ClZW+eGQRe9joGBGcyez5t9H:d9YidRMwq3ObRqZW+e5Re9MWv
TLSH:	F4073350E0D4ACEAC772563BAD768101A6A2BF1507BCCA5F6731B0061EB31C1697EF2D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

File Icon


Icon Hash:	1262a1a0aa92aa8a

Static PE Info

General

Entrypoint:	0x14000ce20
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6757FC0C [Tue Dec 10 08:30:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F0698E060DCh
dec eax
add esp, 28h
jmp 00007F0698E05CFFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F0698E064A8h
test eax, eax
je 00007F0698E05EA3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F0698E05E87h
dec eax
cmp ecx, eax
je 00007F0698E05E96h
xor eax, eax
dec eax
cmpxchg dword ptr [0003570Ch], ecx
jne 00007F0698E05E70h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F0698E05E79h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F0698E05E89h
mov byte ptr [000356F5h], 00000001h
call 00007F0698E055D5h
call 00007F0698E068C0h
test al, al
jne 00007F0698E05E86h
xor al, al
jmp 00007F0698E05E96h
call 00007F0698E133DFh
test al, al
jne 00007F0698E05E8Bh
xor ecx, ecx
call 00007F0698E068D0h
jmp 00007F0698E05E6Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000356BCh], 00000000h
mov ebx, ecx
jne 00007F0698E05EE9h
cmp ecx, 01h
jnbe 00007F0698E05EECh
call 00007F0698E0641Eh
test eax, eax
je 00007F0698E05EAAh
test ebx, ebx
jne 00007F0698E05EA6h
dec eax
lea ecx, dword ptr [000356A6h]
call 00007F0698E131D2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca34	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x19a1c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2238	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x61000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f70	0x2a000	b8c3814c5fb0b18492ad4ec2ffe0830a	False	0.5518740699404762	data	6.489205819736506	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a28	0x12c00	9fc67d9a6c6aee64134355d12ce23875	False	0.5242838541666667	data	5.750772231906574	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2238	0x2400	9cd1eac931545f28ab09329f8bfce843	False	0.4697265625	data	5.2645170849678795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x19a1c	0x19c00	35db13bd970349e79d066a52e38a415a	False	0.07967991504854369	data	3.7032712285528175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x61000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x471d8	0xdcf	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.925035360678925
RT_ICON	0x47fa8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	0.02200402224062463
RT_ICON	0x587d0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.05402692489371753
RT_ICON	0x5c9f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.0766597510373444
RT_ICON	0x5efa0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.12781425891181988
RT_ICON	0x60048	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.28102836879432624
RT_GROUP_ICON	0x604b0	0x5a	data	0.7666666666666667
RT_MANIFEST	0x6050c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 08:43:09.503896952 CET	49711	443	192.168.2.6	162.159.136.232
Dec 13, 2024 08:43:09.503959894 CET	443	49711	162.159.136.232	192.168.2.6
Dec 13, 2024 08:43:09.505917072 CET	49711	443	192.168.2.6	162.159.136.232
Dec 13, 2024 08:43:09.513106108 CET	49711	443	192.168.2.6	162.159.136.232
Dec 13, 2024 08:43:09.513130903 CET	443	49711	162.159.136.232	192.168.2.6
Dec 13, 2024 08:43:10.736417055 CET	443	49711	162.159.136.232	192.168.2.6
Dec 13, 2024 08:43:10.737076044 CET	49711	443	192.168.2.6	162.159.136.232
Dec 13, 2024 08:43:10.737108946 CET	443	49711	162.159.136.232	192.168.2.6
Dec 13, 2024 08:43:10.738668919 CET	443	49711	162.159.136.232	192.168.2.6
Dec 13, 2024 08:43:10.738759041 CET	49711	443	192.168.2.6	162.159.136.232
Dec 13, 2024 08:43:10.740219116 CET	49711	443	192.168.2.6	162.159.136.232
Dec 13, 2024 08:43:10.740387917 CET	49711	443	192.168.2.6	162.159.136.232

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 08:43:09.315706968 CET	51039	53	192.168.2.6	1.1.1.1
Dec 13, 2024 08:43:09.455245018 CET	53	51039	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 08:43:09.315706968 CET	192.168.2.6	1.1.1.1	0x29ea	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 08:43:09.455245018 CET	1.1.1.1	192.168.2.6	0x29ea	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:43:09.455245018 CET	1.1.1.1	192.168.2.6	0x29ea	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:43:09.455245018 CET	1.1.1.1	192.168.2.6	0x29ea	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:43:09.455245018 CET	1.1.1.1	192.168.2.6	0x29ea	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Dec 13, 2024 08:43:09.455245018 CET	1.1.1.1	192.168.2.6	0x29ea	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	02:43:02
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\shost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\shost.exe"
Imagebase:	0x7ff786880000
File size:	16'895'360 bytes
MD5 hash:	E6C0AA5771A46907706063AE1D8B4FB9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:43:04
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\shost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\shost.exe"
Imagebase:	0x7ff786880000
File size:	16'895'360 bytes
MD5 hash:	E6C0AA5771A46907706063AE1D8B4FB9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MuckStealer, Description: Yara detected Muck Stealer, Source: 00000002.00000002.3395068991.00000271C50A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 00007FF786888BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF786889400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7868845E4,00000000,00007FF786881985), ref: 00007FF786889439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888C46

Part of subcall function 00007FF78689A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78689A500

Part of subcall function 00007FF78689878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868987F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888CD6
CreateProcessW.KERNELBASE ref: 00007FF786888D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888D18

Part of subcall function 00007FF786882C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF786883706,?,00007FF786883804), ref: 00007FF786882C9E
Part of subcall function 00007FF786882C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF786883706,?,00007FF786883804), ref: 00007FF786882D63
Part of subcall function 00007FF786882C50: MessageBoxW.USER32 ref: 00007FF786882D99

RegisterClassW.USER32 ref: 00007FF786888D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888D7B
CreateWindowExW.USER32 ref: 00007FF786888DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888E05
PeekMessageW.USER32 ref: 00007FF786888E29
TranslateMessage.USER32 ref: 00007FF786888E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888E41
PeekMessageW.USER32 ref: 00007FF786888E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888FF4
GetExitCodeProcess.KERNEL32 ref: 00007FF786889009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786889012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF78688901F

Strings

Failed to create child process!, xrefs: 00007FF786888D20
PyInstallerOnefileHiddenWindow, xrefs: 00007FF786888D44
PyInstaller Onefile Hidden Window, xrefs: 00007FF786888D85
CreateProcessW, xrefs: 00007FF786888D27

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: 438da8d0c0de37b86482c8b13a192400b1c9f3c284d2a92ccb293e5260d435ca
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 5CD1A531A08B82A6E710AF35EC542ABB761FF84B59FA00235DE5D47694DF3CD964C710

Function 00007FF786881000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-python-flag, xrefs: 00007FF786883AD6
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF786883D12
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF786883EA6
VCRUNTIME140.dll, xrefs: 00007FF786883DB1
Py_GIL_DISABLED, xrefs: 00007FF786883AF4
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF786883882, 00007FF7868838AF
pyi-contents-directory, xrefs: 00007FF786883B8D
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF786883BE8
Failed to start splash screen!, xrefs: 00007FF786883ED4
_PYI_ARCHIVE_FILE, xrefs: 00007FF7868838D2, 00007FF7868839FF
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF786883C61
pyi-runtime-tmpdir, xrefs: 00007FF786883B68
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF786883D35
Failed to load splash screen resources!, xrefs: 00007FF786883E85
Failed to convert DLL search path!, xrefs: 00007FF786883DDC
_PYI_SPLASH_IPC, xrefs: 00007FF786883A23, 00007FF786883EF5
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF786883B32
Could not create temporary directory!, xrefs: 00007FF786883CBF
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7868839DE
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF786883A17, 00007FF786883A2F, 00007FF786883A9B
Failed to remove temporary directory: %s, xrefs: 00007FF786883FC3
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF786883EBB
pkg, xrefs: 00007FF7868839BE
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF786883E0A
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF786883971
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF786883A0B, 00007FF786883CD4, 00007FF786883F6B
MEI, xrefs: 00007FF786883933
pyi-disable-windowed-traceback, xrefs: 00007FF786883BB2

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 221ee4957dd18ffe06ee3afddcba002a7644656f480b66111b2d55fc76433b33
Instruction ID: 7997b903bcd1d4eed58883a138d33c9e5965fdff2f3ff563d0f4a66b698a1807
Opcode Fuzzy Hash: 221ee4957dd18ffe06ee3afddcba002a7644656f480b66111b2d55fc76433b33
Instruction Fuzzy Hash: 76328061A0868276FA25BB65DC543BBA691BF48B80FE44035DA5D432C2EF2CED74C321

Function 00007FF7868A5C70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7868A5CB5

Part of subcall function 00007FF7868A5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A561C

Part of subcall function 00007FF78689A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9CE
Part of subcall function 00007FF78689A9B8: GetLastError.KERNEL32(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9D8

Part of subcall function 00007FF78689A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF78689A94F,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689A979
Part of subcall function 00007FF78689A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF78689A94F,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689A99E

_get_daylight.LIBCMT ref: 00007FF7868A5CA4

Part of subcall function 00007FF7868A5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A567C

_get_daylight.LIBCMT ref: 00007FF7868A5F1A
_get_daylight.LIBCMT ref: 00007FF7868A5F2B
_get_daylight.LIBCMT ref: 00007FF7868A5F3C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7868A617C), ref: 00007FF7868A5F63

Strings

Eastern Standard Time, xrefs: 00007FF7868A6009
Eastern Summer Time, xrefs: 00007FF7868A6021

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction ID: f269eb636b40f83b90217a0a694437bb284b441e3b7b8fbbe173de4a4873b2e5
Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction Fuzzy Hash: DDD1E522A0820266E721BF22DC515BBA752FF44795FE48135DE0D47A85EF3CECA1C362

Function 00007FF7868A69D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7868A6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A6749
Part of subcall function 00007FF7868A6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A67C7
Part of subcall function 00007FF7868A6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A6818

CreateFileW.KERNELBASE ref: 00007FF7868A6ADA
CreateFileW.KERNEL32 ref: 00007FF7868A6B2A
GetLastError.KERNEL32 ref: 00007FF7868A6B5A
GetFileType.KERNELBASE ref: 00007FF7868A6B6F
GetLastError.KERNEL32 ref: 00007FF7868A6B79
CloseHandle.KERNEL32 ref: 00007FF7868A6BAC
CloseHandle.KERNEL32 ref: 00007FF7868A6D0F
CreateFileW.KERNEL32 ref: 00007FF7868A6D44
GetLastError.KERNEL32 ref: 00007FF7868A6D53

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: 3171dfbe549b8d5a575667b336bac2fc80750441a655accd573b209428e1d0c9
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 42C10432B28A4295EB10EF66C8906AE7761F748B98F615235DF2E573D4DF38E861C310

Function 00007FF7868A5EEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7868A5F1A

Part of subcall function 00007FF7868A5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A567C

_get_daylight.LIBCMT ref: 00007FF7868A5F2B

Part of subcall function 00007FF7868A5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A561C

_get_daylight.LIBCMT ref: 00007FF7868A5F3C

Part of subcall function 00007FF7868A5638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A564C

Part of subcall function 00007FF78689A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9CE
Part of subcall function 00007FF78689A9B8: GetLastError.KERNEL32(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9D8

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7868A617C), ref: 00007FF7868A5F63

Strings

Eastern Standard Time, xrefs: 00007FF7868A6009
Eastern Summer Time, xrefs: 00007FF7868A6021

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction ID: d85df6983de4796410c255be07c94f9412824f40e8ee58feaf04f3c59d629aad
Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction Fuzzy Hash: FF51C631A08642A6E750FF32EC915ABE761BB48785FE04135DE0D43A96DF3CE8A1C761

Function 00007FF7868892F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF786889323
FindClose.KERNELBASE ref: 00007FF786889332

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: b1332d000ec5f340ea4a1df85e41ec7272790a3c7aa0ed4c4a4cae79f870e271
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 95F06822A1874296FB609B64B849777B350FB84764F941335D96D02AD4DF3CD869CB10

Function 00007FF7868A0938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction ID: e46cd28029d3678a396474e12fa5e81059154fd499b2ddbecbc7173e0ab1010f
Opcode Fuzzy Hash: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction Fuzzy Hash: 5C02CF21A1D64261FA60BB129C1127BA680BF45BA9FF54634DD6D463D2EE3DFC31C322

Function 00007FF786881950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF786887F80: _fread_nolock.LIBCMT ref: 00007FF78688802A

_fread_nolock.LIBCMT ref: 00007FF786881A1B

Part of subcall function 00007FF786882910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF786881B6A), ref: 00007FF78688295E

Strings

calloc, xrefs: 00007FF786881A68
malloc, xrefs: 00007FF786881B22
Error on file., xrefs: 00007FF786881B8D
Could not allocate memory for archive structure!, xrefs: 00007FF786881A61
fseek, xrefs: 00007FF7868819F5
fread, xrefs: 00007FF786881A32, 00007FF786881B5C
Could not read full TOC!, xrefs: 00007FF786881B55
MEI, xrefs: 00007FF786881991
Failed to read cookie!, xrefs: 00007FF786881A2B
Failed to seek to cookie position!, xrefs: 00007FF7868819EE
Could not allocate buffer for TOC!, xrefs: 00007FF786881B1B

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: f8096cce2067d15cebc3bdaacbdc60c8b6a2e1e4d6ea3146b715ff88ef4c1dca
Instruction ID: 5d3eeb9d97ec27f1a87f5db144c8365455cd6b26130d5cfdf597f18d37084262
Opcode Fuzzy Hash: f8096cce2067d15cebc3bdaacbdc60c8b6a2e1e4d6ea3146b715ff88ef4c1dca
Instruction Fuzzy Hash: 7281C571A1C683A9E720EB15D8406BBA3A2FF44B84FE04035D98D47786EE3CED65C760

Function 00007FF786881600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7868816A2
Failed to create symbolic link %s!, xrefs: 00007FF786881622
malloc, xrefs: 00007FF786881749
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7868817CA
Failed to extract %s: failed to open target file!, xrefs: 00007FF78688165C
fopen, xrefs: 00007FF786881663
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF786881742
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7868816DA
fseek, xrefs: 00007FF7868816E1
fread, xrefs: 00007FF7868817E6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7868817DF
fwrite, xrefs: 00007FF7868817D1

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: e33f210c217a6ffcc68d29fe46a5e37371bf7e5689aecd108357e4c1f5d99a01
Instruction ID: 1ffdf0340a463e01c4bc35ad65cebf53aa21542038603b3c6465b969e06ec171
Opcode Fuzzy Hash: e33f210c217a6ffcc68d29fe46a5e37371bf7e5689aecd108357e4c1f5d99a01
Instruction Fuzzy Hash: 3151AE21B18643A6EA10BB129C015ABE3A1BF44B94FE44135EE8C47796EF3CFD65C760

Function 00007FF786888850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF786883CBB), ref: 00007FF7868888F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF786883CBB), ref: 00007FF7868888FA
CreateDirectoryW.KERNELBASE(?,00000000,00007FF786883CBB), ref: 00007FF78688893C

Part of subcall function 00007FF786888A20: GetEnvironmentVariableW.KERNEL32(00007FF78688388E), ref: 00007FF786888A57
Part of subcall function 00007FF786888A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF786888A79

Part of subcall function 00007FF7868982A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868982C1

Part of subcall function 00007FF786882810: MessageBoxW.USER32 ref: 00007FF7868828EA

Strings

TMP, xrefs: 00007FF78688888C, 00007FF786888993
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7868888CC
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF78688896E
_MEI%d, xrefs: 00007FF786888902
TMP, xrefs: 00007FF7868888B2

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction ID: e80f85e9115bd43bfd1e125a96ca807e243bdb7f044dfdcdd7aec694fa0634d8
Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction Fuzzy Hash: 0241A351A1864365FA20FB66AC552BB9291BF88B84FE00031DD0D4B7D6EE3CED21C721

Function 00007FF786881210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.3.1, xrefs: 00007FF786881249
malloc, xrefs: 00007FF7868812C1, 00007FF7868812F6
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7868812BA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7868812EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF786881276
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF78688141E

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
Instruction ID: 48d92ab5e57d2e909a0196a2dc40c0e968f3a15ec074bb16271c88c7a2ad4f37
Opcode Fuzzy Hash: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
Instruction Fuzzy Hash: E751D222A1864365E660BB12AC103BBE291BF85B98FE44135ED8D477D5EF3CED21C720

Function 00007FF7868836B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF786883804), ref: 00007FF7868836E1
GetLastError.KERNEL32(?,00007FF786883804), ref: 00007FF7868836EB

Part of subcall function 00007FF786882C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF786883706,?,00007FF786883804), ref: 00007FF786882C9E
Part of subcall function 00007FF786882C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF786883706,?,00007FF786883804), ref: 00007FF786882D63
Part of subcall function 00007FF786882C50: MessageBoxW.USER32 ref: 00007FF786882D99

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF786883790
Failed to obtain executable path., xrefs: 00007FF7868836F3
GetModuleFileNameW, xrefs: 00007FF7868836FA
Failed to resolve full path to executable %ls., xrefs: 00007FF786883739
\\?\, xrefs: 00007FF78688375A

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: b959de0d5084b33c3ffb6be68ab4057664d1f31ce870a0e2ad482121e6d76bce
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 6F21A751B1C642B5FE20B725EC113B7A361BF88B55FE00132D95E825D5EE2CED25C361

Function 00007FF78689BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78689BEF9

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
Instruction ID: 3fe11dfb4f17d52e7ca9e7b3a904445dc9338b43c0ac86570b593e5a383f281f
Opcode Fuzzy Hash: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
Instruction Fuzzy Hash: 65C1B52290C686A9E751AB1598402BFA766FF81B84FF54131EA4E037D1EE7CFC65C720

Function 00007FF786888760 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF786888780
OpenProcessToken.ADVAPI32 ref: 00007FF786888793
GetTokenInformation.KERNELBASE ref: 00007FF7868887B8
GetLastError.KERNEL32 ref: 00007FF7868887C2
GetTokenInformation.KERNELBASE ref: 00007FF786888802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF78688881E
CloseHandle.KERNEL32 ref: 00007FF786888836

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction ID: 737e1cc9e312d5382d2dd48a68685e994e9840502e45c352efb8c21d7b852d4f
Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction Fuzzy Hash: B5219131A0C64352EB10AB55F85023BE7A1FF85BA1FA00235EAAD47AE4DF7CD864C710

Function 00007FF7868890E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF786888760: GetCurrentProcess.KERNEL32 ref: 00007FF786888780
Part of subcall function 00007FF786888760: OpenProcessToken.ADVAPI32 ref: 00007FF786888793
Part of subcall function 00007FF786888760: GetTokenInformation.KERNELBASE ref: 00007FF7868887B8
Part of subcall function 00007FF786888760: GetLastError.KERNEL32 ref: 00007FF7868887C2
Part of subcall function 00007FF786888760: GetTokenInformation.KERNELBASE ref: 00007FF786888802
Part of subcall function 00007FF786888760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF78688881E
Part of subcall function 00007FF786888760: CloseHandle.KERNEL32 ref: 00007FF786888836

LocalFree.KERNEL32(?,00007FF786883C55), ref: 00007FF78688916C
LocalFree.KERNEL32(?,00007FF786883C55), ref: 00007FF786889175

Strings

D:(A;;FA;;;%s), xrefs: 00007FF786889157
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF786889142
S-1-3-4, xrefs: 00007FF786889121
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF786889183

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction ID: ef3bf6fad5dbd0aa3349c71074ff84d0aa20490984f6e11aa704c6540b5942df
Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction Fuzzy Hash: FA214F25A08742A5FA10BB11ED153EBA265FF84B80FE44031EA4D53B86DF3CEC15C760

Function 00007FF786887E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF78688352C,?,00000000,00007FF786883F23), ref: 00007FF786887F22

Strings

\, xrefs: 00007FF786887E87
%s%c, xrefs: 00007FF786887E94
%.*s, xrefs: 00007FF786887EDB

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
Instruction ID: 0e615587edf77ffd1bd11e1794e7ee4dbe2f48831fa020e9eafb92a69419043b
Opcode Fuzzy Hash: 8ca7fb79b4ea6b2c566bb37e9ebd00ba932afb87f6e77ad964f7d4209dd14296
Instruction Fuzzy Hash: 2831D821619AC165EA21AB11EC507EBA364FF94FE4F940231EE6D43BC9DE2CDA11C710

Function 00007FF78689CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78689CFBB), ref: 00007FF78689D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78689CFBB), ref: 00007FF78689D177

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: 314405e92c54fe47af876ef52776881fa842567d37adf484145b950fdbd80306
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 5E910E32F18A51A5F750AF659C4027EABA0BB45788FB44135DE0D53686EE3CFC62CB24

Function 00007FF78689F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF78689FAEC
_get_daylight.LIBCMT ref: 00007FF78689FAFD
_get_daylight.LIBCMT ref: 00007FF78689FB0E
_isindst.LIBCMT ref: 00007FF78689FBD9

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 4094a66d5b99ca3d403801d18793965d5da29ac97c06b9f3adbb7227d4bb10b0
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 74510772F08111AAFB28EF249D556BEB7A1BB00358FB04135DE1E52AE4EB38BC51C710

Function 00007FF7868957EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF78689581F
GetFileInformationByHandle.KERNELBASE ref: 00007FF786895881
GetLastError.KERNEL32 ref: 00007FF786895912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF786895724), ref: 00007FF78689595E

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: f99fc6d47d5cf4a6cbd26f2c241bfaaac3c51670f09e7bd9ec395e9a80d1c405
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 3451D262E186419AFB11EF71E8503BEA3B1BB44B58FA44435DE4D57688EF38E861C321

Function 00007FF786895698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868956C5
CreateFileW.KERNELBASE ref: 00007FF786895704
CloseHandle.KERNEL32 ref: 00007FF786895739

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
Instruction ID: 34dd8e7d0931d4145ed8793a1c6ed29c14a7d2ec580079bc391c4c5de8f72986
Opcode Fuzzy Hash: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
Instruction Fuzzy Hash: 4441B522D18782A7E711AB21995037AB360FB94764F609334EA5C03AD1EF7CB9F0C721

Function 00007FF78688CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78688CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF78688CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF78688CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF78688CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF78688CD91

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: beedc2530818bd3f20e9735d9b598f19e1bf10e76e5436f8ed69fdf564e3ff3f
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: DD313810E4824375FA64BB25DC223BB9691BF41B84FE44434E94D476DBDE2CBC25C671

Function 00007FF7868901AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868901F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868902E7

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 665c93adb0c584f00bd214158fe094e281fa43c5923644cbf4b420326caaadac
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: C251F621B0924266E764AA759C0067BE291BF44BA8FB44738DE6D437C5EF3CFC21D620

Function 00007FF78689C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF78689C33D), ref: 00007FF78689C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF78689C33D), ref: 00007FF78689C1FA

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 2dbfb5474d542de2611190ac62ffe3654f8399c72199d0216cb257f0209406b1
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 2711E761718B8191DA10AB25AC1426AE361BB45BF4FB44331EE7D4B7D9DF7CE821C700

Function 00007FF786895994 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7868958A9), ref: 00007FF7868959C7
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7868958A9), ref: 00007FF7868959DD

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
Instruction ID: 8ace470f172627c7f2821f3faac3b785b6b8a0c00cd256615bad490d332f231c
Opcode Fuzzy Hash: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
Instruction Fuzzy Hash: 0C11A37261C61292EB54AB51A84113FF7A0FB84771FA00235FADD819D8FF6CE824CB20

Function 00007FF78689A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9CE
GetLastError.KERNEL32(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9D8

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 774ea465db3869487028056138b5d626f31bcc8fa99dad765c66b46427e2cb87
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 84E04F10E1860267FF147BB29C5513B92517F88741FA50030C81D422A1EE2CBCA5C320

Function 00007FF78689ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF78689AA45,?,?,00000000,00007FF78689AAFA), ref: 00007FF78689AC36
GetLastError.KERNEL32(?,?,?,00007FF78689AA45,?,?,00000000,00007FF78689AAFA), ref: 00007FF78689AC40

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 0a7110f359e1e6a0c7f033f335cff42f2b88689ea5dfbc941ec59c8e950b9473
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 4321A411B1C64261EE9077619C9027B9292BF847A4FB84235DA1E4B3C1EE6CFC65C320

Function 00007FF78689BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78689BF44

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 77f2f9c0c3853e5df4dc99a11e1b25eaa2aec769d06f52d5773e5caefc843251
Instruction ID: 8997ef36e8d08448af129c917bb73bba53ee60a7b9851b75f2aa102892bb567e
Opcode Fuzzy Hash: 77f2f9c0c3853e5df4dc99a11e1b25eaa2aec769d06f52d5773e5caefc843251
Instruction Fuzzy Hash: 6E41D6329082019BEB34AB16A94427BB3A5FB55B54FB00131DA8E436D1EF6DFC52CB71

Function 00007FF786887F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF78688802A

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: c7509c5c59c4a666db98ff03363a6938e2dccbe5af1fc5850b6eda6e7b6e2098
Instruction ID: a0401811d907a02e121748e563ddec2030a19939cd3a8e8091dad5b2dace5c1f
Opcode Fuzzy Hash: c7509c5c59c4a666db98ff03363a6938e2dccbe5af1fc5850b6eda6e7b6e2098
Instruction Fuzzy Hash: C121D661B49652A5FA20BA226D043BBE691BF45FD8FEC4430EE0D0F786DE7DE851C610

Function 00007FF78689B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78689BA32

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: 2641597b1bcdb6f08cf892f11f01822c6d5307bbb622eca379daa64d4c4d0e81
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: F8316D31A28642A9E7517B558C4127FA691BB40BA4FE10135E92D273D2EEBCFC61C731

Function 00007FF786896004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF786895F69

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: d5cfce93e65802c74b1b11083c1f75275c8c99e29acdeddc64114d30c52a7a43
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 61116222A1864291EA61BF11980017FE260BF45B98FE44031EB4C57A96EFBDFD60C722

Function 00007FF7868A63C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A63E7

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 675be22f4dea1f475448b76cd36bd846d34dafe06e7aa2872b1e4e170037bc1c
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 9D212972608A4297D760AF19D84077AB3A0FB80B55FB40234EA9E476D9DF3CDC60CB10

Function 00007FF78689042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF786890480

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 75912b1bf679fed69e5c81c0d616f01fe24bb1b898691c92ace4de55fb2e9e87
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 1A010861A0874150E910FF525D0106AE691BF91FE4FA84634DE5C53BD6EE3CF821C710

Function 00007FF786897F6C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF786897FAA

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction ID: f090db4f5b285477d903c9cdacff65f9e73b3680bd070995a928458a105faf27
Opcode Fuzzy Hash: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction Fuzzy Hash: E0016D20A0D64360FAA07B215D0117BD190BF447A8FF44535EB1D526C6EFACBC72C231

Function 00007FF7868982A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868982C1

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: acd5d908dae84a6d84db828dae075d3e50ca6577d6f35f8a44f019e429683827
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: FCE0ECA0E18A07A6F6143AE44D8217B91107F5A344FF15870EA0C1A2C3FEBD7C69D631

Function 00007FF78689EC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF78689B39A,?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA), ref: 00007FF78689EC5D

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction ID: d9d8ed657a9068b35c4e0db45b499d1f2434a4b39ec4de4383699b30913f19ff
Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction Fuzzy Hash: 96F03C50B1960766FE547A626C652B78A817F45B84FAC5430D94E86391FD5CFCB1C230

Function 00007FF78689D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF786890D00,?,?,?,00007FF78689236A,?,?,?,?,?,00007FF786893B59), ref: 00007FF78689D6AA

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 017bc7437dd84b26760dbd645b9478d37f1b666bfec2f0458e8ff71825126909
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 26F03A14A0DB0265FE5676625C1127AA2907F957A0FA84230DE2E853C2EE6CBC60C974

Non-executed Functions

Function 00007FF786885820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF786885830
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF786885842
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF786885879
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF78688588B
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868858A4
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868858B6
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868858CF
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868858E1
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868858FD
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF78688590F
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF78688592B
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF78688593D
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF786885959
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF78688596B
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF786885987
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF786885999
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868859B5
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868859C7

Strings

PyModule_GetDict, xrefs: 00007FF786885CB9, 00007FF786885CDB
Py_DecRef, xrefs: 00007FF786885826, 00007FF786885848
PyObject_CallFunctionObjArgs, xrefs: 00007FF786885D15, 00007FF786885D37
PyUnicode_FromFormat, xrefs: 00007FF786885F3D, 00007FF786885F5F
PySys_SetObject, xrefs: 00007FF786885E85, 00007FF786885EA7
PyConfig_SetString, xrefs: 00007FF786885A35, 00007FF786885A57
PyUnicode_AsUTF8, xrefs: 00007FF786885EB3, 00007FF786885ED5
PyErr_Fetch, xrefs: 00007FF786885ABF, 00007FF786885AE1
PyErr_Occurred, xrefs: 00007FF786885B1B, 00007FF786885B3D
PyErr_Clear, xrefs: 00007FF786885A91, 00007FF786885AB3
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF786885DCD, 00007FF786885DEF
Py_InitializeFromConfig, xrefs: 00007FF7868858F3, 00007FF786885915
PyUnicode_FromString, xrefs: 00007FF786885F6B, 00007FF786885F8D
PyConfig_Read, xrefs: 00007FF7868859D9, 00007FF7868859FB
PyEval_EvalCode, xrefs: 00007FF786885BA5, 00007FF786885BC7
PyUnicode_DecodeFSDefault, xrefs: 00007FF786885F0F, 00007FF786885F31
PyConfig_Clear, xrefs: 00007FF78688597D, 00007FF78688599F
Failed to get address for %hs, xrefs: 00007FF786885851
PyObject_SetAttrString, xrefs: 00007FF786885D71, 00007FF786885D93
PyConfig_SetBytesString, xrefs: 00007FF786885A07, 00007FF786885A29
PyMarshal_ReadObjectFromString, xrefs: 00007FF786885C5D, 00007FF786885C7F
PyImport_ImportModule, xrefs: 00007FF786885C2F, 00007FF786885C51
PyConfig_InitIsolatedConfig, xrefs: 00007FF7868859AB, 00007FF7868859CD
PyUnicode_Replace, xrefs: 00007FF786885FC7, 00007FF786885FE9
Py_PreInitialize, xrefs: 00007FF78688594F, 00007FF786885971
PyObject_Str, xrefs: 00007FF786885D9F, 00007FF786885DC1
Py_DecodeLocale, xrefs: 00007FF78688586F, 00007FF786885891
PyUnicode_Decode, xrefs: 00007FF786885EE1, 00007FF786885F03
PyStatus_Exception, xrefs: 00007FF786885E29, 00007FF786885E4B
GetProcAddress, xrefs: 00007FF786885858
PySys_GetObject, xrefs: 00007FF786885E57, 00007FF786885E79
PyObject_GetAttrString, xrefs: 00007FF786885D43, 00007FF786885D65
PyMem_RawFree, xrefs: 00007FF786885C8B, 00007FF786885CAD
PyRun_SimpleStringFlags, xrefs: 00007FF786885DFB, 00007FF786885E1D
Py_ExitStatusException, xrefs: 00007FF78688589A, 00007FF7868858BC
PyObject_CallFunction, xrefs: 00007FF786885CE7, 00007FF786885D09
Py_IsInitialized, xrefs: 00007FF786885921, 00007FF786885943
PyUnicode_Join, xrefs: 00007FF786885F99, 00007FF786885FBB
PyImport_AddModule, xrefs: 00007FF786885BD3, 00007FF786885BF5
Py_Finalize, xrefs: 00007FF7868858C5, 00007FF7868858E7
PyErr_NormalizeException, xrefs: 00007FF786885AED, 00007FF786885B0F
PyErr_Print, xrefs: 00007FF786885B49, 00007FF786885B6B
PyImport_ExecCodeModule, xrefs: 00007FF786885C01, 00007FF786885C23
PyErr_Restore, xrefs: 00007FF786885B77, 00007FF786885B99
PyConfig_SetWideStringList, xrefs: 00007FF786885A63, 00007FF786885A85

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: ce75427a784e0e5f74f45ae2c3caa6ddfef49f28481a8729d3e78feca5847dff
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: 34229524A49B47B5FA95BB56AD50277A3A1BF04B56FE41035CC1E02360EF7CED78C222

Function 00007FF7868A411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7868A416A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A47D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A494C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A4C0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A4E2A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A5067
memcpy_s.LIBCPMT ref: 00007FF7868A5142
memcpy_s.LIBCPMT ref: 00007FF7868A51ED
memcpy_s.LIBCPMT ref: 00007FF7868A52BC

Strings

1#SNAN, xrefs: 00007FF7868A427A
1#IND, xrefs: 00007FF7868A4257
1#INF, xrefs: 00007FF7868A4293
1#QNAN, xrefs: 00007FF7868A4283

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction ID: 0c0383e953bc31c05e5e85539a9e7f1421ecc1f2729aa4c8509a2e75dcd0c27a
Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction Fuzzy Hash: 6AB23972E182829BEB259F66D9407FEB3A1FB44349FA01135DE0D57A84DB38ED20CB51

Function 00007FF7868883B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF786888B09,00007FF786883FA5), ref: 00007FF78688841B
RemoveDirectoryW.KERNEL32(?,00007FF786888B09,00007FF786883FA5), ref: 00007FF78688849E
DeleteFileW.KERNEL32(?,00007FF786888B09,00007FF786883FA5), ref: 00007FF7868884BD
FindNextFileW.KERNEL32(?,00007FF786888B09,00007FF786883FA5), ref: 00007FF7868884CB
FindClose.KERNEL32(?,00007FF786888B09,00007FF786883FA5), ref: 00007FF7868884DC
RemoveDirectoryW.KERNEL32(?,00007FF786888B09,00007FF786883FA5), ref: 00007FF7868884E5

Strings

%s\*, xrefs: 00007FF7868883E2

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: ded52e21894fb40567f0cd365215e39380ed7354b0157a87048cd12689cfa2aa
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: AF41A062A0C943A5EA30BB21EC445BBA3A5FF94B50FE00232D99D466C4DF3CED56C720

Function 00007FF78688AD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid literal/length code, xrefs: 00007FF78688B452
too many length or distance symbols, xrefs: 00007FF78688AEB6
invalid distances set, xrefs: 00007FF78688B210
invalid distance too far back, xrefs: 00007FF78688B6E0
invalid bit length repeat, xrefs: 00007FF78688B109
invalid literal/lengths set, xrefs: 00007FF78688B1A3
invalid distance code, xrefs: 00007FF78688B624
invalid code lengths set, xrefs: 00007FF78688AE9D
invalid code -- missing end-of-block, xrefs: 00007FF78688B136

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction ID: b2a640164f3b62e2c95abf0fa394c15fa7ce7200fc3421e56d7e19c41bd49079
Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction Fuzzy Hash: 30521872A146AA9BD7A49F14C858B7E7BAAFB84740F514138EA4E877C0DB3CDC50CB10

Function 00007FF78688D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF78688D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF78688D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78688D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF78688D240
IsDebuggerPresent.KERNEL32 ref: 00007FF78688D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78688D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78688D2BC

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: 9d75b1113054d2fb331f7db43c923384e283103b4617b015ac9b0d72fb6b7c38
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 21315372608B819AEB609F61EC803EEB361FB88745F94403ADA4D47B95DF3CD958C720

Function 00007FF78689A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF78689A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78689A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF78689A750
IsDebuggerPresent.KERNEL32 ref: 00007FF78689A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78689A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78689A79E

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: 6d4fd482c85bd7a40884fcf087a0e9f48c4e323a183cd58a4507cfbaac2abe28
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: 10316436618B8196D760DF25EC402AFB3A4FB88754FA40136EA8D43B58EF3CD555CB10

Function 00007FF7868A18E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A1930
FindFirstFileExW.KERNEL32 ref: 00007FF7868A1A3A

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction ID: 64cdd60047b320c9d8144e239ccdc5194dddd32b31bbcd7269d75422acd347b7
Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction Fuzzy Hash: 6CB1A422B1869251EA60AB629D001BBE3A1FB44BE5FE45131DE9D17BC5EF3CEC61C311

Function 00007FF78688D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF78688D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF78688D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF78688D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF78688D0D6

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: e33f877b0c3400c062c6459c327c8d0d4595e5f27f299ae574f67bd03c07446c
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 0B118822B14B069AEB00DF61EC442BA73B0FB08758F840E31DE2D82BA4DF38D4A4C350

Function 00007FF7868A3C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7868A3CE6
memcpy_s.LIBCPMT ref: 00007FF7868A3D11

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: cccf4507d1302c48915365813094ec97afee7d276533fc89fa4e001dfd7f6ebf
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: D6C1E272B1868697EB249F1AA44467AF7A1F794B85FA48134DF4E43B44DB3DEC20CB40

Function 00007FF78688A4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF78688A991
, xrefs: 00007FF78688A5CB
unknown header flags set, xrefs: 00007FF78688A535

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction ID: 913c7241f3658fd758f871a491b45035a87afca9df18cf7f98e8b419ec4abc49
Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction Fuzzy Hash: DDF19362A183C55BE7A5AB18C888B3BBAA9FF44B40F654538DE4D473D4CB38ED50C750

Function 00007FF7868A9798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7868A99E7
RaiseException.KERNEL32 ref: 00007FF7868A99F8

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction ID: a0dce90f905b28234a60d1682be694c26a0699323e5d39368b1dd432a6a2ae1a
Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction Fuzzy Hash: C4B17F73A18B858BEB15CF2AC84636977E0F744B49F688822DF5D837A4CB39D861C711

Function 00007FF786893A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF786893DC4
, xrefs: 00007FF786893B82

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction ID: 284c3923e569f777bcacb398d514fdd18639a511253d06dd358affd0a561ca87
Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction Fuzzy Hash: BCE1B536A08A4697EB68AF39895413EB3A0FF45B48FB44135DA4E07794EF29FC61C710

Function 00007FF78688A34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF78688A4B2
incorrect header check, xrefs: 00007FF78688A4CB

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction ID: 5dec4e32702f1b1c5c6130b4c62dc590912776cb8416ee7e8c77dcb91b1dbe01
Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction Fuzzy Hash: 6991A672A182CA9BE7A49E14C888B3F7AA9FF44750F654139DA5E467C0DB38ED50CB10

Function 00007FF78689DF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF78689E06D
gfff, xrefs: 00007FF78689E0EA

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction ID: da0a4528f1acf0918644227ddc71ae9b8ebb17a0b6b11de3fccaeb408351a44f
Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction Fuzzy Hash: 3C517822B182C196E7249F35AC0476AAB91FB45B94F988231CB6C47BC5EF7DF860C710

Function 00007FF78689DACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF78689DE0E

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 4330eeb9c57840510109d03545963bd394c63e9c83fcc12e02ae540534c655b5
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: C1A15763A08BC557EB21DF25A8007AEBB91BB60784F648031DE4D47786EE3DE911CB11

Function 00007FF786898804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF786898823

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction ID: ad08a999505ad21c631f92863c10ae197dd893a9a037fd6b8e9e1a575324bc03
Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction Fuzzy Hash: 5B519D51B1824361FA68BA265D1157BD2907F84B84FE84834DE5E5BBD6FE3CFC22C221

Function 00007FF7868A34F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7868A34F4

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction ID: aa8ed0308c7bbf8059025c88422e8e4e6301d19afe34747937e865fe1388f7e0
Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction Fuzzy Hash: A5B09B10E07701D6ED443B115C8211552557F4C711FE40135C40C40330DE2C18F59711

Function 00007FF786893610 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction ID: 79f4902ad5b81cd101b2d800d6549244f944e77607aec1666c379964acd4c124
Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction Fuzzy Hash: ECD1D966A08642A7EB29AE35885023FA3A1FB45B48FB44135CE0D57794EF39FC61C360

Function 00007FF786889870 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction ID: 247b0f545d2a8bf5ba25001a2d808a84ce0762621efce147a3a6843e7ae38d02
Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction Fuzzy Hash: 6FC17E762181E08BD289EB29E86947A73D1F78930DBE5406BEF87477C5C73CA514DB20

Function 00007FF786892C80 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction ID: 945395379e2b5b1fc39887eaf3ccb5e8470c2ff5ddfb893f71c229c56e6f37b7
Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction Fuzzy Hash: 5FB1CF32A2878595E7649F39C8A113EFBA0FB09B48FB40135CA4D47395EF79E861C760

Function 00007FF78689E5E0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction ID: 5e02df510544ed641897147e5054dded83d312174f288a56aceaca45a148ea6e
Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction Fuzzy Hash: 1081F372A0878157E7789B19A84437BAA91FF45794FA44235DB8D03B95EE3DE820CB10

Function 00007FF7868A6488 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b78332369169aed8be6dd13cc6d08ed8a401c1151d3c5d6e5b3c154adaf735d2
Instruction ID: 384b4b8970bf17d5ac9de7d270e3fa57e84316c6bfff1503b303f904fb95e2cf
Opcode Fuzzy Hash: b78332369169aed8be6dd13cc6d08ed8a401c1151d3c5d6e5b3c154adaf735d2
Instruction Fuzzy Hash: E761F922E0C59266F764A92A8814A3FE580BF41361FB84239DF1D467CDEE7DEC90C721

Function 00007FF786891DC4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 943d66a525ed558f9cc6f8578711c0d7528e8aec68670191c96cfbf74d823406
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 78518236A1C65692E7649B29C84023EB3A0FB44B58F744231DE8D17B94EB7AFC62C750

Function 00007FF7868919B4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 2801a79d14c7e0fe203beb71c5fba65a76e4e0caf2bdd0cff519f8f2f0fb9556
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 10519036A1C65196E7249B29C44023AB3B1FB44B68FB44131CA8D277A4EF3AFC67C750

Function 00007FF7868921D4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 60d38a55432f70d61c9299b48490d159dfc9da2033cdc8f1110dcedf957ada0c
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 9D517132A3865196E7249B69C85123AE3A0FB58B58F744131CE4C177A4EB3AFC63C750

Function 00007FF7868917B0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 7f36479acb04e549c12ad20c9a57d3a71227acb3d706b00e78456196661687f7
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 2C51B436A1C65196E7689B28C84023EA3A1FB44F58FB44031CE8C27794EF3AFC62D750

Function 00007FF786891FD0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 92c66b8d27857acaf87ad5c6a55cea389c1119e3e6820f102335f05cc34dccd7
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 8B51C232A2865195E7249B29C86123AF7A0FB45B58FB44131CE4C177A8EF3AFC62C750

Function 00007FF786891BC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: c5bc2752484bb5d623913bd6faa8010a9e71041da6f643564cc157c746e1c641
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: D9519036A1CA5196E7249B29C84023AA7A1FB45B5CFB44131CE8D177A4EF3AFC63C750

Function 00007FF786895DA0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: a0a6e9bc1f243306bd549244cd557697445bd151498603a594fc8341caeed5fc
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: C441C66280964A64E96799280D046BED780BF62BF4DF812B0DC9D533C6FD1D3DA7C123

Function 00007FF786899F10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction ID: 1a8dafd108c8552e652ad209780fc75d938eed8558a29685090b91314255375e
Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction Fuzzy Hash: FF41F422714A5592EF04DF2AED1416AB3A1BB48FD0F999032EE0D97B54EE3DD852C300

Function 00007FF786898154 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: cd3ca3b0c94070108ebe8d6028b8c1455a9ad107e222b4e6a3f7a75d3fcedfb5
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: D431D772B08B4242E754AF226C4013FA595BB85BD0F644239EE9D57BD5EF3CE821C314

Function 00007FF7868A95E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction ID: bf78389fac903d9189891d86c8eabb8ab36fb200c8aa92de6ea4972eba6acfb1
Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction Fuzzy Hash: E2F044717282559BDB98AF6DB84262A77D0F748390F908139D68D83B04DA3CD462DF14

Function 00007FF78688D37C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction ID: b21f332d3825c9cdadfec9ccdb426cfef775fbb2fbb41e559eb5380ebf6f510e
Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction Fuzzy Hash: CFA0012190C80AF4E644AB01ACA0466A321FB55702FA00032E40D424A0EE2CAC20D721

Function 00007FF7868876B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7868876C7
GetLastError.KERNEL32 ref: 00007FF7868876D9
GetProcAddress.KERNEL32 ref: 00007FF786887715
GetLastError.KERNEL32 ref: 00007FF786887727
GetProcAddress.KERNEL32 ref: 00007FF786887740
GetLastError.KERNEL32 ref: 00007FF786887752
GetProcAddress.KERNEL32 ref: 00007FF78688776B
GetLastError.KERNEL32 ref: 00007FF78688777D
GetProcAddress.KERNEL32 ref: 00007FF786887799
GetLastError.KERNEL32 ref: 00007FF7868877AB
GetProcAddress.KERNEL32 ref: 00007FF7868877C7
GetLastError.KERNEL32 ref: 00007FF7868877D9
GetProcAddress.KERNEL32 ref: 00007FF7868877F5
GetLastError.KERNEL32 ref: 00007FF786887807
GetProcAddress.KERNEL32 ref: 00007FF786887823
GetLastError.KERNEL32 ref: 00007FF786887835
GetProcAddress.KERNEL32 ref: 00007FF786887851
GetLastError.KERNEL32 ref: 00007FF786887863

Strings

Tcl_Init, xrefs: 00007FF7868876C0, 00007FF7868876DF
Tcl_EvalEx, xrefs: 00007FF786887BB1, 00007FF786887BD3
Tcl_GetCurrentThread, xrefs: 00007FF786887847, 00007FF786887869
Tcl_GetObjResult, xrefs: 00007FF786887B55, 00007FF786887B77
Tcl_DeleteInterp, xrefs: 00007FF7868877EB, 00007FF78688780D
Tk_Init, xrefs: 00007FF786887C69, 00007FF786887C8B
Tcl_CreateThread, xrefs: 00007FF786887819, 00007FF78688783B
Tcl_DoOneEvent, xrefs: 00007FF786887761, 00007FF786887783
Tcl_ConditionNotify, xrefs: 00007FF78688795B, 00007FF78688797D
Tcl_FinalizeThread, xrefs: 00007FF7868877BD, 00007FF7868877DF
Tcl_GetVar2, xrefs: 00007FF786887A13, 00007FF786887A35
Tcl_SetVar2, xrefs: 00007FF786887A41, 00007FF786887A63
Tcl_ConditionFinalize, xrefs: 00007FF78688792D, 00007FF78688794F
Failed to get address for %hs, xrefs: 00007FF7868876E8
Tcl_FindExecutable, xrefs: 00007FF786887736, 00007FF786887758
Tcl_MutexFinalize, xrefs: 00007FF7868878FF, 00007FF786887921
Tcl_CreateInterp, xrefs: 00007FF78688770B, 00007FF78688772D
Tcl_CreateObjCommand, xrefs: 00007FF786887A6F, 00007FF786887A91
Tcl_EvalFile, xrefs: 00007FF786887B83, 00007FF786887BA5
Tcl_ThreadQueueEvent, xrefs: 00007FF7868879B7, 00007FF7868879D9
Tcl_NewByteArrayObj, xrefs: 00007FF786887AF9, 00007FF786887B1B
Tcl_JoinThread, xrefs: 00007FF786887875, 00007FF786887897
Tcl_EvalObjv, xrefs: 00007FF786887BDF, 00007FF786887C01
Tcl_Alloc, xrefs: 00007FF786887C0D, 00007FF786887C2F
Tcl_ThreadAlert, xrefs: 00007FF7868879E5, 00007FF786887A07
Tcl_Free, xrefs: 00007FF786887C3B, 00007FF786887C5D
GetProcAddress, xrefs: 00007FF7868876EF
Tcl_NewStringObj, xrefs: 00007FF786887ACB, 00007FF786887AED
Tcl_SetVar2Ex, xrefs: 00007FF786887B27, 00007FF786887B49
Tcl_ConditionWait, xrefs: 00007FF786887989, 00007FF7868879AB
Tcl_Finalize, xrefs: 00007FF78688778F, 00007FF7868877B1
Tcl_GetString, xrefs: 00007FF786887A9D, 00007FF786887ABF
Tk_GetNumMainWindows, xrefs: 00007FF786887C97, 00007FF786887CB9
Tcl_MutexUnlock, xrefs: 00007FF7868878D1, 00007FF7868878F3
Tcl_MutexLock, xrefs: 00007FF7868878A3, 00007FF7868878C5

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: b7e6c0f7080c5394b129f1579ef3379d0b18bf695f598663895e5abb30fe5253
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 7C02A42090DB07B4EA54BB56AD505BBA361BF04B56FF41031D95E422A0EF7CFD68C232

Function 00007FF7868881C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF786889400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7868845E4,00000000,00007FF786881985), ref: 00007FF786889439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7868888A7,?,?,00000000,00007FF786883CBB), ref: 00007FF78688821C

Part of subcall function 00007FF786882810: MessageBoxW.USER32 ref: 00007FF7868828EA

Strings

LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7868881F3
CreateDirectory, xrefs: 00007FF78688836C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF786888230
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF786888363
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF78688828D
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7868882C9
%.*s, xrefs: 00007FF7868882FC
\, xrefs: 00007FF786888251

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction ID: dab16422224a87450ab669de7dcf317e36ac18fc6b551cc608f837afce2e92d5
Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction Fuzzy Hash: 6051B851A18642B5FB60FB25EC512BBE291FF94B81FE44031DA0E866D5EF2CEC24C760

Function 00007FF786882180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7868821AB
SelectObject.GDI32 ref: 00007FF7868821F2
DrawTextW.USER32 ref: 00007FF786882215
SelectObject.GDI32 ref: 00007FF78688222B
ReleaseDC.USER32 ref: 00007FF78688223B
MoveWindow.USER32 ref: 00007FF78688228B
MoveWindow.USER32 ref: 00007FF7868822CB
MoveWindow.USER32 ref: 00007FF78688231E
MoveWindow.USER32 ref: 00007FF786882366

Strings

P%, xrefs: 00007FF7868821FF

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: aea5a987af94b89fd91d4f14867a71dc2804fc1ffbe8bcea858fbe427819369d
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 48510726614BA186D6349F26E8181BBF7A1FB98B62F104131EFDE43694DF3CD455CB20

Function 00007FF7868880B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7868880EF
GetWindowLongPtrW.USER32 ref: 00007FF78688816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF786888182
GetLastError.KERNEL32 ref: 00007FF78688818C
SetWindowLongPtrW.USER32 ref: 00007FF7868881A3

Strings

Needs to remove its temporary files., xrefs: 00007FF786888175

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: dbecf21c6b57b83a82042a90f62d88acd9b0bd1f3a952b3370318b3d4cdbe5f8
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: 6021D365B09A4292E751AB7AAD4417BE251FF88F91FA84130DE2D473D4DE2CDDA0C321

Function 00007FF786896300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF786896343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF786896730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868969CC

Strings

f, xrefs: 00007FF786896465
:, xrefs: 00007FF7868964FC
p, xrefs: 00007FF7868963F5
p, xrefs: 00007FF78689646D
-, xrefs: 00007FF7868963D9

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 11f983cfab09e40dcd94958a0f2ec509d6fccee5f44fc3d70b49902cb7dfe7ed
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: B1127061A0C153A6FB247B149954A7BF6A1FB40750FE84135E68E46AC4EB3CFDE0DB20

Function 00007FF786891038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF786891078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF786891440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868916DF

Strings

f, xrefs: 00007FF78689117A
p, xrefs: 00007FF78689111D
p, xrefs: 00007FF786891182
f, xrefs: 00007FF786891110
f, xrefs: 00007FF7868912C5

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: b2e8acd4dbe8837da0b47fc2a0965fbe87dee985d8d36ab0021dc6111c1598ed
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: A4125E32E0C143A5FB24BA55E85467BA262FB41754FE84035E6DD46BC4EB7CF8A0DB20

Function 00007FF786881050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF786881098
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF786881108
malloc, xrefs: 00007FF78688110F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7868810CC
fseek, xrefs: 00007FF7868810D3
fread, xrefs: 00007FF7868811FD
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7868811F6

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 459c70ac1d7639bc8463e208505d68a8d1b4527688a9ba0853ea1617660c4a39
Instruction ID: 5856060444445bedea1e9987b49ab4bc4e4e4ed5f2f7d2cff03340908795a096
Opcode Fuzzy Hash: 459c70ac1d7639bc8463e208505d68a8d1b4527688a9ba0853ea1617660c4a39
Instruction Fuzzy Hash: 9D416D25A18653A6EA10FB12AC006BBE391BF54FC4FE44432ED4D47796EE3CE925C760

Function 00007FF786881470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF78688149F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF786881518
malloc, xrefs: 00007FF78688151F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7868814DE
fseek, xrefs: 00007FF7868814E5
fread, xrefs: 00007FF7868815E6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7868815DF

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 0b283387f8163d2c1451a1fd9c7ee0611bebd7135be36a4017c4ebfd3c397b14
Instruction ID: feb900763a8b230532dceae8de79ad601e3d16dc9fbb0a9f4766156222dcc3a8
Opcode Fuzzy Hash: 0b283387f8163d2c1451a1fd9c7ee0611bebd7135be36a4017c4ebfd3c397b14
Instruction Fuzzy Hash: 11418021A18643A9EB10EB229C015BBE391BF44B98FE44432ED4D07B95EF3CED25C761

Function 00007FF78688EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF78688EAD5

Part of subcall function 00007FF78688FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF78688FA6F
Part of subcall function 00007FF78688FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF78688FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF78688EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF78688EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF78688EF08

Strings

csm, xrefs: 00007FF78688EB56
csm, xrefs: 00007FF78688EAEF
csm, xrefs: 00007FF78688EBD0

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: 0175cd00535e90fe6745a9ce39f04f2b9fc869f4c5c34bff979055195bc0ce8e
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: BBD19232A0874197EB20EF65E8443AEB7A0FB55B98F600135EE4D57B96DF38E860C710

Function 00007FF78689ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF78689F11A,?,?,000002162E2E8B68,00007FF78689ADC3,?,?,?,00007FF78689ACBA,?,?,?,00007FF786895FAE), ref: 00007FF78689EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF78689F11A,?,?,000002162E2E8B68,00007FF78689ADC3,?,?,?,00007FF78689ACBA,?,?,?,00007FF786895FAE), ref: 00007FF78689EF08

Strings

api-ms-, xrefs: 00007FF78689EE46
ext-ms-, xrefs: 00007FF78689EE59

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: 09e59fd32b45a94c5035fa03d43adf9da5d58995c333a2338ba9b2e39a59e429
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: CB41B321B19A1266EA15EB16AC0857BA791BF48B90FE84539DD1D47784EE3CFC25C320

Function 00007FF786882C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF786883706,?,00007FF786883804), ref: 00007FF786882C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF786883706,?,00007FF786883804), ref: 00007FF786882D63
MessageBoxW.USER32 ref: 00007FF786882D99

Strings

[PYI-%d:ERROR] , xrefs: 00007FF786882CA6
<FormatMessageW failed.>, xrefs: 00007FF786882D70
Error, xrefs: 00007FF786882D8C
%ls: , xrefs: 00007FF786882D22

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: 354b0d2f2e59e7d0e6090f44bfe78338ae979c7e36ff76cea8f0748642dfb16d
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: CE310822708B4166E720BB21BC106ABA692BF88BC9F900135EF4D93759EF3CD916C310

Function 00007FF78688DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF78688DFEA,?,?,?,00007FF78688DCDC,?,?,?,00007FF78688D8D9), ref: 00007FF78688DDBD
GetLastError.KERNEL32(?,?,?,00007FF78688DFEA,?,?,?,00007FF78688DCDC,?,?,?,00007FF78688D8D9), ref: 00007FF78688DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF78688DFEA,?,?,?,00007FF78688DCDC,?,?,?,00007FF78688D8D9), ref: 00007FF78688DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF78688DFEA,?,?,?,00007FF78688DCDC,?,?,?,00007FF78688D8D9), ref: 00007FF78688DE63
GetProcAddress.KERNEL32(?,?,?,00007FF78688DFEA,?,?,?,00007FF78688DCDC,?,?,?,00007FF78688D8D9), ref: 00007FF78688DE6F

Strings

api-ms-, xrefs: 00007FF78688DDDD

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: bd9e8b975e1c356c54e31faf7cc674de7d6d5d3142161216ff9d617bde7497ae
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: 8C316121B1AA42A5EE52AB12AC00576E394FF58FA0FB94535ED1D47784EF3CE864C720

Function 00007FF786886350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7868863F7
Failed to load Python DLL '%ls'., xrefs: 00007FF786886497
ucrtbase.dll, xrefs: 00007FF7868863CD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF786886446
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7868863B7
LoadLibrary, xrefs: 00007FF78688649E

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
Instruction ID: 8e6d736b6a036913ec27039f631ad4c470e59d33526330c51c9a70b3410b52a9
Opcode Fuzzy Hash: c6b32316bfe7a0aff6899d53276924ef6fe1744c5bc58fcca4aca07baf8add6e
Instruction Fuzzy Hash: 87418321A18687B1EA21FB25E8152EBA361FF54740FE00132DA5D43695EF3CED65C361

Function 00007FF786882A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF78688351A,?,00000000,00007FF786883F23), ref: 00007FF786882AA0

Strings

0, xrefs: 00007FF786882B16
[PYI-%d:%s] , xrefs: 00007FF786882AA8
Warning, xrefs: 00007FF786882B1E
Warning [ANSI Fallback], xrefs: 00007FF786882B0F
WARNING, xrefs: 00007FF786882AAF

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 75da2a18e35ea2fbdc216ba120d0993621886b892c6cd49cdd0867d5e8c4c1ca
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: EE218132A18782A6E720EB51BC817E7A7A4FB887C4F900132EE8D53659DF3CDA55C750

Function 00007FF78689B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF78689B1CF
FlsGetValue.KERNEL32 ref: 00007FF78689B1E4
FlsSetValue.KERNEL32 ref: 00007FF78689B205
FlsSetValue.KERNEL32 ref: 00007FF78689B232
FlsSetValue.KERNEL32 ref: 00007FF78689B243
FlsSetValue.KERNEL32 ref: 00007FF78689B254
SetLastError.KERNEL32 ref: 00007FF78689B26F

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction ID: e68434411429e203eee3280b112217bf10f4a093fff05d38d5bed55016097dac
Opcode Fuzzy Hash: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction Fuzzy Hash: 28216020E0C2466AF66877A15E5513FE142BF487A0FB44634E83E06AD6EE3CBC20C320

Function 00007FF7868A7DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7868A7E0D
GetLastError.KERNEL32 ref: 00007FF7868A7E19
CloseHandle.KERNEL32 ref: 00007FF7868A7E31
CreateFileW.KERNEL32 ref: 00007FF7868A7E5C
WriteConsoleW.KERNEL32 ref: 00007FF7868A7E7B

Strings

CONOUT$, xrefs: 00007FF7868A7E3D

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: fba6de0e6791b03a0d2e21769cdaaa59ae50f350ebfe17d143e8542a6c8ca807
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: 08118121B18A419AE350AB52FC5432AA7A5FB88FE5FA00234EE5D87794DF3CDC24C751

Function 00007FF786888560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF786889216), ref: 00007FF786888592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF786889216), ref: 00007FF7868885E9

Part of subcall function 00007FF786889400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7868845E4,00000000,00007FF786881985), ref: 00007FF786889439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF786889216), ref: 00007FF786888678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF786889216), ref: 00007FF7868886E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF786889216), ref: 00007FF7868886F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF786889216), ref: 00007FF78688870A

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction ID: 87f552efd3625441346ac1bde6f992750101ce7c8356770f3e7217aeb4f7d7d1
Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction Fuzzy Hash: 3641B562B1868255EA30BB11AD446ABA3A4FF84FC4F944035DF4D97B89DF3CE911C720

Function 00007FF78689B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA,?,?,?,?,00007FF7868971FF), ref: 00007FF78689B347
FlsSetValue.KERNEL32(?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA,?,?,?,?,00007FF7868971FF), ref: 00007FF78689B37D
FlsSetValue.KERNEL32(?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA,?,?,?,?,00007FF7868971FF), ref: 00007FF78689B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA,?,?,?,?,00007FF7868971FF), ref: 00007FF78689B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA,?,?,?,?,00007FF7868971FF), ref: 00007FF78689B3CC
SetLastError.KERNEL32(?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA,?,?,?,?,00007FF7868971FF), ref: 00007FF78689B3E7

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction ID: d973d0eb85e2775bd28e3ce22eec01055da7de951f7a618c7075c8d04d351cf2
Opcode Fuzzy Hash: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction Fuzzy Hash: 6C112F20A0C642ABF758B7315E5513FE1867F447A0FB48734D86E46AD6EE2CBC21D321

Function 00007FF786882910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF786881B6A), ref: 00007FF78688295E

Strings

Error [ANSI Fallback], xrefs: 00007FF7868829FF
[PYI-%d:ERROR] , xrefs: 00007FF786882966
Error, xrefs: 00007FF786882A0E
%s: %s, xrefs: 00007FF7868829E8

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: c53cf0ca2dd6ffdd1027e49762a4549e9f1a0e165130f18d4361c15acb5e1f0e
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: FF310822B1868166E720B761BC416E7A295BF88BD4F900132FE8D83759EF3CD966C310

Function 00007FF786882390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7868823C8
DialogBoxIndirectParamW.USER32 ref: 00007FF78688248E
DeleteObject.GDI32 ref: 00007FF7868824C1
DestroyIcon.USER32 ref: 00007FF7868824D3

Strings

Unhandled exception in script, xrefs: 00007FF7868823F8

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction ID: a26fd914a809d7c20ffd9d3c0fd2f471e85d74eb31464f0feffde1f652b2f9cf
Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction Fuzzy Hash: 1431723261968299EB20EF61EC552FAA360FF88788FA40135EE4D47B49EF3CD511C711

Function 00007FF786882B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF78688918F,?,00007FF786883C55), ref: 00007FF786882BA0
MessageBoxW.USER32 ref: 00007FF786882C2A

Strings

Warning, xrefs: 00007FF786882C1D
[PYI-%d:%ls] , xrefs: 00007FF786882BA8
WARNING, xrefs: 00007FF786882BAF

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: fc67fdc945d40235a9f4750c750f646c2808b8f9528543974b28c7f8085a8d23
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: A321D162708B41A6E710AB15F8447ABB7A4FB887C4F900132EE8D53659DE3CDA25C750

Function 00007FF786882710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF786881B99), ref: 00007FF786882760

Strings

Error [ANSI Fallback], xrefs: 00007FF7868827CF
ERROR, xrefs: 00007FF78688276F
[PYI-%d:%s] , xrefs: 00007FF786882768
Error, xrefs: 00007FF7868827DE

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: 1fc03723e7ae4b43991be68509645ee2bb179d24d2abfe68550d8f393fdcc785
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: B8218132A18781A6E720EB51BC817E7A7A4FB887C4F900131EE8D53659DF3CD955C750

Function 00007FF786899AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF786899B1D
GetProcAddress.KERNEL32 ref: 00007FF786899B33
FreeLibrary.KERNEL32 ref: 00007FF786899B5A

Strings

CorExitProcess, xrefs: 00007FF786899B2C
mscoree.dll, xrefs: 00007FF786899B14

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: b017633bd496a61cec96040c0e4381d273a6e12fb44abfc8e903c4988d0ff04a
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: BEF04F21A09606A1EA10AB25AC5537BA361BF45762FE80235DA6E461E4DF2CE854C321

Function 00007FF7868A93D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7868A9400
_set_statfp.LIBCMT ref: 00007FF7868A941B
_set_statfp.LIBCMT ref: 00007FF7868A9437
_set_statfp.LIBCMT ref: 00007FF7868A9473

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: d3786464e3e0c3334d5dbf39440754ad19e0c6c7e1c1d494ccb5b90287d131a1
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 76119062E7DA1221FF743126DC96377A0447F58362EA40634EF7E062D6CE2CEC61C122

Function 00007FF78689B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF78689A613,?,?,00000000,00007FF78689A8AE,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689B41F
FlsSetValue.KERNEL32(?,?,?,00007FF78689A613,?,?,00000000,00007FF78689A8AE,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689B43E
FlsSetValue.KERNEL32(?,?,?,00007FF78689A613,?,?,00000000,00007FF78689A8AE,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689B466
FlsSetValue.KERNEL32(?,?,?,00007FF78689A613,?,?,00000000,00007FF78689A8AE,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689B477
FlsSetValue.KERNEL32(?,?,?,00007FF78689A613,?,?,00000000,00007FF78689A8AE,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689B488

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction ID: 4c0d77788fa23747d89523d1bcbeaa6265704e9d7ba86dfdc7cb4fcc0a1a4e7c
Opcode Fuzzy Hash: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction Fuzzy Hash: 0C116320A086026AFA68B3216D5117BE1467F447B0FF88334E87D566D6EE2CBC21D720

Function 00007FF78689B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF78689B2A5
FlsSetValue.KERNEL32 ref: 00007FF78689B2C4
FlsSetValue.KERNEL32 ref: 00007FF78689B2EC
FlsSetValue.KERNEL32 ref: 00007FF78689B2FD
FlsSetValue.KERNEL32 ref: 00007FF78689B30E

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction ID: a36a426d07d9f36da92833db1230d073858e7cfbd2803bcea330342786a34fb1
Opcode Fuzzy Hash: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction Fuzzy Hash: C2110620A092066AFA68B3715C1517FA1867F49760FF88734D93E5A6C2FE2CBC21D321

Function 00007FF786896010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78689604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF786896176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78689622C

Strings

verbose, xrefs: 00007FF786896020

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 0660798fe3960bab89680a2b0d589c6e1ad8bd9d5274ff5b9316a77fea504db3
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 5091CC32A08A46A5F721AF64DC50B7EB291BB45B94FE44132DA4D432C5EE3CFCA5C320

Function 00007FF78689FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78689FF17

Part of subcall function 00007FF786897AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF786897AC9

Strings

ccs, xrefs: 00007FF78689FE52
UTF-8, xrefs: 00007FF78689FE96
UTF-16LEUNICODE, xrefs: 00007FF78689FEB5

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: 4db75222d53dfbcf1cb667d084fc93df46b78851541aea7b0f042cbce59aba4e
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: A8818132E0C242A5F76C6F25895027EB6A0BF11748FF58035DA0E97695EB2DFD21D321

Function 00007FF78688D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF78688D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF78688D77A
RtlUnwindEx.KERNEL32 ref: 00007FF78688D7D4

Strings

csm, xrefs: 00007FF78688D761

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: bd804a114ffd2138a2a590143e07f77face305f3f50390ad30ed311141d8c71b
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 2651A132B19602AADB54AF15E844A3AB7A1FB44F98FA44530DE4D47B48DF7CEC61CB10

Function 00007FF78688EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF78688EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF78688EFF3

Strings

MOC, xrefs: 00007FF78688EFBB
RCC, xrefs: 00007FF78688EFC3

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: feac780e042bdbf1c920995d476569db75c97600e2984dc9a20f3f67f8c0bf5d
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 5961C172908BC596E731AB15E8403AAF7A0FB84BC4F544225EB8C07B99DF7CD5A0CB10

Function 00007FF78688F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF78688F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF78688F408

Strings

csm, xrefs: 00007FF78688F45A
csm, xrefs: 00007FF78688F342

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: fa07fca1383a16e3a5e807b89b117cea1d8e17d731c49545448e81e18dbada54
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: 6D518032908382D6EB74AF21994427AB6A0FB94FD4FA48136DA5D47795CF3CEC60C711

Function 00007FF786882810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7868828EA

Strings

Error, xrefs: 00007FF7868828DD
ERROR, xrefs: 00007FF78688286F
[PYI-%d:%ls] , xrefs: 00007FF786882868

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: bafd3ef12296ebc86a1710abba9c39545a6822f2eac066062a24186dab257bcb
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: 3921D162B08B41A6E710AB15F8447EBB7A1FB88784F900132EE8D53659DF3CDA65C750

Function 00007FF78689C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF78689C68F
WriteFile.KERNEL32 ref: 00007FF78689C957
WriteFile.KERNEL32 ref: 00007FF78689C99D
GetLastError.KERNEL32 ref: 00007FF78689CA53

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: 5d6d95c92dcbc0a395b4781f538883abcc10579904d58b12b1638d7d547bb12b
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: FCD14972B186809AE710DF65D8403ED77B1FB44798FA08235CE5D67B89EE39E826C350

Function 00007FF7868820C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7868820F4
SetWindowLongPtrW.USER32 ref: 00007FF786882116
GetWindowLongPtrW.USER32 ref: 00007FF786882140
InvalidateRect.USER32 ref: 00007FF786882160

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 5f6e7416d0a87d29fee86b88f77ea6a07fef8c3c38fb3ee82fcc953a9f085559
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 9C11C625A1C14252F654A76AED5527B9292FF84B81FE44030DE4D07B89CD3DECA1C250

Function 00007FF7868A5B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7868A17D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A1803

_get_daylight.LIBCMT ref: 00007FF7868A5CA4
_get_daylight.LIBCMT ref: 00007FF7868A5CB5

Strings

?, xrefs: 00007FF7868A5C35

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction ID: 2fe6aa5e1a9d07c4ecce242be6cab11595c49a2b9f472a5dca3283ade030baf5
Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction Fuzzy Hash: 9A414C12A0828162FB25B716EC0137BD651FB90BA5FB44235EF5C06AD9DF3CD8A1C712

Function 00007FF786899084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868990B6

Part of subcall function 00007FF78689A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9CE
Part of subcall function 00007FF78689A9B8: GetLastError.KERNEL32(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF78688CC15), ref: 00007FF7868990D4

Strings

C:\Users\user\Desktop\shost.exe, xrefs: 00007FF7868990C2

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\shost.exe
API String ID: 3580290477-2881294525
Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction ID: 99fd8187acac3632bc0b78e197cd58387b5a924de38d3d18f8efa98ec1ffb203
Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction Fuzzy Hash: 98418131A08B02A5EB14BF259C910BEA3A4FB457D0FE94035E94D43B85EE3DECA1C320

Function 00007FF78689CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF78689CDBF
GetLastError.KERNEL32 ref: 00007FF78689CDE1

Strings

U, xrefs: 00007FF78689CD6B

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: 43713cf6f30144cee7e302d846f67f013f13b27f82fc671ba6bb74f00ef0e53d
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: BA41D632B18A8195DB60DF25E8443AAA760FB88794FA04031EE4D87B98EF3DE811C750

Function 00007FF78689F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF78689F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF78689F6BA

Strings

:, xrefs: 00007FF78689F67E

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction ID: 3571984de55b9c68e7de0bda7693d152d0459020119988b200e799a28f81430d
Opcode Fuzzy Hash: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction Fuzzy Hash: AD212522A0838192EB24AB15D80422FB3B1FB84B44FE14035CB8C43684EF7CED64CB61

Function 00007FF78688FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF78688FE08
RaiseException.KERNEL32 ref: 00007FF78688FE49

Strings

csm, xrefs: 00007FF78688FE36

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: 33334e2d54aa868b198f9f16b0290658234dcef9eb05bcdc3ca54d99c8bf4581
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: D3112132618B8192EB619F15F84026AB7E5FB88B84F684231EF8D07759DF3CD961C710

Function 00007FF7868A07AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A07DC
GetDriveTypeW.KERNEL32 ref: 00007FF7868A081C

Strings

:, xrefs: 00007FF7868A0805

Memory Dump Source

Source File: 00000000.00000002.3393400751.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000000.00000002.3393381323.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393437897.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393465856.00007FF7868C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3393504193.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff786880000_shost.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: 2eac4813aed6ac5e8bd0c3bc86fcd25e6d1e8c041b920415b1ce83ead92cfdec
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: C001712291820396F720BF61986527FA2A0FF44749FE40035D94D42691EE3DE924CA25

Analysis Process: shost.exePID: 1880, Parent PID: 4576COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.3%
Total number of Nodes:	772
Total number of Limit Nodes:	11

Executed Functions

Function 00007FFDA3567C48 Relevance: 131.6, APIs: 48, Strings: 27, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_libversion_number.SQLITE3 ref: 00007FFDA3567C55
sqlite3_initialize.SQLITE3 ref: 00007FFDA3567C66
PyModule_GetState.PYTHON312 ref: 00007FFDA3567CD7
PyModule_AddType.PYTHON312 ref: 00007FFDA3567CE7
PyModule_AddType.PYTHON312 ref: 00007FFDA3567CFC
PyModule_AddType.PYTHON312 ref: 00007FFDA3567D14
PyModule_AddType.PYTHON312 ref: 00007FFDA3567D2C
PyModule_AddType.PYTHON312 ref: 00007FFDA3567D44
PyErr_NewException.PYTHON312 ref: 00007FFDA3567D66
PyModule_AddType.PYTHON312 ref: 00007FFDA3567D7F
PyErr_NewException.PYTHON312 ref: 00007FFDA3567DA1
PyModule_AddType.PYTHON312 ref: 00007FFDA3567DBA
PyErr_NewException.PYTHON312 ref: 00007FFDA3567DD6
PyModule_AddType.PYTHON312 ref: 00007FFDA3567DEF
PyErr_NewException.PYTHON312 ref: 00007FFDA3567E0B
PyModule_AddType.PYTHON312 ref: 00007FFDA3567E24
PyErr_NewException.PYTHON312 ref: 00007FFDA3567E40
PyModule_AddType.PYTHON312 ref: 00007FFDA3567E59
PyErr_NewException.PYTHON312 ref: 00007FFDA3567E75
PyModule_AddType.PYTHON312 ref: 00007FFDA3567E8E
PyErr_NewException.PYTHON312 ref: 00007FFDA3567EAA
PyModule_AddType.PYTHON312 ref: 00007FFDA3567EC3
PyErr_NewException.PYTHON312 ref: 00007FFDA3567EDF
PyModule_AddType.PYTHON312 ref: 00007FFDA3567EF8
PyErr_NewException.PYTHON312 ref: 00007FFDA3567F14
PyModule_AddType.PYTHON312 ref: 00007FFDA3567F2C
PyErr_NewException.PYTHON312 ref: 00007FFDA3567F48
PyModule_AddType.PYTHON312 ref: 00007FFDA3567F61
PyUnicode_InternFromString.PYTHON312 ref: 00007FFDA3567F76
PyUnicode_InternFromString.PYTHON312 ref: 00007FFDA3567F93
PyUnicode_InternFromString.PYTHON312 ref: 00007FFDA3567FB0
PyUnicode_InternFromString.PYTHON312 ref: 00007FFDA3567FCD
PyUnicode_InternFromString.PYTHON312 ref: 00007FFDA3567FEA
PyUnicode_InternFromString.PYTHON312 ref: 00007FFDA3568007
PyUnicode_InternFromString.PYTHON312 ref: 00007FFDA3568024
PyUnicode_InternFromString.PYTHON312 ref: 00007FFDA3568041

Part of subcall function 00007FFDA35683A0: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356805F), ref: 00007FFDA35683D8

Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA356842A
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA3568448
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA3568464
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA3568480
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA356849C
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA35684B8
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA35684D4
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA35684F0
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA356850C
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA3568528
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA3568544
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA3568560
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA356857C
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA3568598
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA35685B4
Part of subcall function 00007FFDA3568410: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FFDA356806F), ref: 00007FFDA35685D0

PyModule_AddStringConstant.PYTHON312 ref: 00007FFDA3568088
sqlite3_libversion.SQLITE3 ref: 00007FFDA3568096
PyModule_AddStringConstant.PYTHON312 ref: 00007FFDA35680A9
PyModule_AddIntConstant.PYTHON312 ref: 00007FFDA35680C5
sqlite3_threadsafe.SQLITE3 ref: 00007FFDA35680D3
PyModule_AddIntConstant.PYTHON312 ref: 00007FFDA35680F6
PyModule_GetState.PYTHON312 ref: 00007FFDA356811B
_PyImport_GetModuleAttrString.PYTHON312 ref: 00007FFDA3568132
sqlite3_shutdown.SQLITE3 ref: 00007FFDA3568153
sqlite3_errstr.SQLITE3 ref: 00007FFDA356D87D
PyErr_SetString.PYTHON312 ref: 00007FFDA356D890
PyErr_Format.PYTHON312 ref: 00007FFDA356D8B1

Part of subcall function 00007FFDA3568160: PyType_FromModuleAndSpec.PYTHON312(?,?,?,00007FFDA3567C7C), ref: 00007FFDA3568177
Part of subcall function 00007FFDA3568160: PyModule_GetState.PYTHON312(?,?,?,00007FFDA3567C7C), ref: 00007FFDA3568188

Part of subcall function 00007FFDA35681A8: PyType_FromModuleAndSpec.PYTHON312(?,?,?,00007FFDA3567C8C), ref: 00007FFDA35681BF
Part of subcall function 00007FFDA35681A8: PyModule_GetState.PYTHON312(?,?,?,00007FFDA3567C8C), ref: 00007FFDA35681D0

Part of subcall function 00007FFDA35681F0: PyType_FromModuleAndSpec.PYTHON312(?,?,?,00007FFDA3567C9C), ref: 00007FFDA3568207
Part of subcall function 00007FFDA35681F0: PyModule_GetState.PYTHON312(?,?,?,00007FFDA3567C9C), ref: 00007FFDA3568218

Part of subcall function 00007FFDA3568234: PyType_FromModuleAndSpec.PYTHON312(?,?,?,00007FFDA3567CAC), ref: 00007FFDA356824B
Part of subcall function 00007FFDA3568234: PyModule_GetState.PYTHON312(?,?,?,00007FFDA3567CAC), ref: 00007FFDA356825C

Part of subcall function 00007FFDA356827C: PyType_FromModuleAndSpec.PYTHON312(?,?,?,00007FFDA3567CBC), ref: 00007FFDA3568293
Part of subcall function 00007FFDA356827C: PyModule_GetState.PYTHON312(?,?,?,00007FFDA3567CBC), ref: 00007FFDA35682A4

Part of subcall function 00007FFDA35682C4: PyType_FromModuleAndSpec.PYTHON312(?,?,?,00007FFDA3567CCC), ref: 00007FFDA35682DB
Part of subcall function 00007FFDA35682C4: PyModule_GetState.PYTHON312(?,?,?,00007FFDA3567CCC), ref: 00007FFDA35682EC

Strings

sqlite3.Warning, xrefs: 00007FFDA3567D94
sqlite3.InterfaceError, xrefs: 00007FFDA3567DCC
sqlite3.Error, xrefs: 00007FFDA3567D59
sqlite3: SQLite 3.7.15 or higher required, xrefs: 00007FFDA356D872
functools, xrefs: 00007FFDA356812B
2.6.0, xrefs: 00007FFDA3568077
finalize, xrefs: 00007FFDA3567FBF
value, xrefs: 00007FFDA3568033
threadsafety, xrefs: 00007FFDA35680EC
upper, xrefs: 00007FFDA3568016
_deprecated_version, xrefs: 00007FFDA3568081
sqlite3.DataError, xrefs: 00007FFDA3567F0A
sqlite3.DatabaseError, xrefs: 00007FFDA3567E01
Unable to interpret SQLite threadsafety mode. Got %d, expected 0, 1, or 2, xrefs: 00007FFDA356D8A7
__conform__, xrefs: 00007FFDA3567F85
sqlite3.NotSupportedError, xrefs: 00007FFDA3567F3E
sqlite_version, xrefs: 00007FFDA356809C
sqlite3.InternalError, xrefs: 00007FFDA3567E36
__adapt__, xrefs: 00007FFDA3567F6F
sqlite3.IntegrityError, xrefs: 00007FFDA3567ED5
sqlite3.ProgrammingError, xrefs: 00007FFDA3567EA0
inverse, xrefs: 00007FFDA3567FDC
sqlite3.OperationalError, xrefs: 00007FFDA3567E6B
executescript, xrefs: 00007FFDA3567FA2
step, xrefs: 00007FFDA3567FF9
LEGACY_TRANSACTION_CONTROL, xrefs: 00007FFDA35680BB
lru_cache, xrefs: 00007FFDA3568121

Memory Dump Source

Source File: 00000002.00000002.3400157554.00007FFDA3561000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FFDA3560000, based on PE: true

Associated: 00000002.00000002.3400141377.00007FFDA3560000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3400178310.00007FFDA356F000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3400198525.00007FFDA3579000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.3400217598.00007FFDA357B000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3560000_shost.jbxd

Similarity

API ID: Module_$Constant$Type$From$Err_String$Exception$InternStateUnicode_$Module$SpecType_$AttrFormatImport_sqlite3_errstrsqlite3_initializesqlite3_libversionsqlite3_libversion_numbersqlite3_shutdownsqlite3_threadsafe
String ID: 2.6.0$LEGACY_TRANSACTION_CONTROL$Unable to interpret SQLite threadsafety mode. Got %d, expected 0, 1, or 2$__adapt__$__conform__$_deprecated_version$executescript$finalize$functools$inverse$lru_cache$sqlite3.DataError$sqlite3.DatabaseError$sqlite3.Error$sqlite3.IntegrityError$sqlite3.InterfaceError$sqlite3.InternalError$sqlite3.NotSupportedError$sqlite3.OperationalError$sqlite3.ProgrammingError$sqlite3.Warning$sqlite3: SQLite 3.7.15 or higher required$sqlite_version$step$threadsafety$upper$value
API String ID: 3715894170-1388897118
Opcode ID: 54b508962b6aba38d9045962bd977d9ca43ac6b102c77c9a3a205e403b4b1b7d
Instruction ID: 49e9ba264986e1eecc43dce3d4fac977ac482ea7ac647609b2edbf3b78200165
Opcode Fuzzy Hash: 54b508962b6aba38d9045962bd977d9ca43ac6b102c77c9a3a205e403b4b1b7d
Instruction Fuzzy Hash: AFE1D060F0FB4352EA4A9B69E8742352392BF46B85F4C5835C91E67352DF3EF0698308

Function 00007FF786881000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF786883D12
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF786883EA6
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF786883BE8
pyi-runtime-tmpdir, xrefs: 00007FF786883B68
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF786883971
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF786883D35
_PYI_ARCHIVE_FILE, xrefs: 00007FF7868838D2, 00007FF7868839FF
MEI, xrefs: 00007FF786883933
VCRUNTIME140.dll, xrefs: 00007FF786883DB1
Py_GIL_DISABLED, xrefs: 00007FF786883AF4
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF786883E0A
pyi-disable-windowed-traceback, xrefs: 00007FF786883BB2
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF786883EBB
Failed to remove temporary directory: %s, xrefs: 00007FF786883FC3
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF786883882, 00007FF7868838AF
_PYI_SPLASH_IPC, xrefs: 00007FF786883A23, 00007FF786883EF5
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF786883A17, 00007FF786883A2F, 00007FF786883A9B
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF786883A0B, 00007FF786883CD4, 00007FF786883F6B
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF786883B32
Failed to load splash screen resources!, xrefs: 00007FF786883E85
Failed to convert DLL search path!, xrefs: 00007FF786883DDC
pyi-contents-directory, xrefs: 00007FF786883B8D
pkg, xrefs: 00007FF7868839BE
Failed to start splash screen!, xrefs: 00007FF786883ED4
Could not create temporary directory!, xrefs: 00007FF786883CBF
pyi-python-flag, xrefs: 00007FF786883AD6
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF786883C61
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7868839DE

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: c0a66ebca772141f760a29a0dd77fc68e5502f7a94feb123d2d63e937376cc0c
Instruction ID: 7997b903bcd1d4eed58883a138d33c9e5965fdff2f3ff563d0f4a66b698a1807
Opcode Fuzzy Hash: c0a66ebca772141f760a29a0dd77fc68e5502f7a94feb123d2d63e937376cc0c
Instruction Fuzzy Hash: 76328061A0868276FA25BB65DC543BBA691BF48B80FE44035DA5D432C2EF2CED74C321

Function 00007FF7868A69D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7868A6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A6749
Part of subcall function 00007FF7868A6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A67C7
Part of subcall function 00007FF7868A6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A6818

CreateFileW.KERNEL32 ref: 00007FF7868A6ADA
CreateFileW.KERNEL32 ref: 00007FF7868A6B2A
GetLastError.KERNEL32 ref: 00007FF7868A6B5A
GetFileType.KERNEL32 ref: 00007FF7868A6B6F
GetLastError.KERNEL32 ref: 00007FF7868A6B79
CloseHandle.KERNEL32 ref: 00007FF7868A6BAC
CloseHandle.KERNEL32 ref: 00007FF7868A6D0F
CreateFileW.KERNEL32 ref: 00007FF7868A6D44
GetLastError.KERNEL32 ref: 00007FF7868A6D53

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: 3171dfbe549b8d5a575667b336bac2fc80750441a655accd573b209428e1d0c9
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 42C10432B28A4295EB10EF66C8906AE7761F748B98F615235DF2E573D4DF38E861C310

Function 00007FF7868892F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF786889323
FindClose.KERNEL32 ref: 00007FF786889332

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: b1332d000ec5f340ea4a1df85e41ec7272790a3c7aa0ed4c4a4cae79f870e271
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 95F06822A1874296FB609B64B849777B350FB84764F941335D96D02AD4DF3CD869CB10

Function 00007FFD93A80180 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FFD93A801A5

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: b0054afb10e4f66619171edf603becae74e7afe6d3d72f3cb96377bce576b712
Instruction ID: 2fafd4cfc4d096db053ba3813f8acfd4f3c8fef4772650264a4b76a93cb1c5cd
Opcode Fuzzy Hash: b0054afb10e4f66619171edf603becae74e7afe6d3d72f3cb96377bce576b712
Instruction Fuzzy Hash: 58A1E865F0AB0796EE78DBCDE4703382298BF55B48F140539CA8E666A0EF7CE590C344

Function 00007FF786881950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF786887F80: _fread_nolock.LIBCMT ref: 00007FF78688802A

_fread_nolock.LIBCMT ref: 00007FF786881A1B

Part of subcall function 00007FF786882910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF786881B6A), ref: 00007FF78688295E

Strings

Failed to read cookie!, xrefs: 00007FF786881A2B
malloc, xrefs: 00007FF786881B22
calloc, xrefs: 00007FF786881A68
Could not allocate memory for archive structure!, xrefs: 00007FF786881A61
fread, xrefs: 00007FF786881A32, 00007FF786881B5C
Could not read full TOC!, xrefs: 00007FF786881B55
Error on file., xrefs: 00007FF786881B8D
Failed to seek to cookie position!, xrefs: 00007FF7868819EE
fseek, xrefs: 00007FF7868819F5
Could not allocate buffer for TOC!, xrefs: 00007FF786881B1B
MEI, xrefs: 00007FF786881991

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: abc02df14881b8553accab44fb79ef53eaa7c88a432e732f5ead529d710b0ae2
Instruction ID: 5d3eeb9d97ec27f1a87f5db144c8365455cd6b26130d5cfdf597f18d37084262
Opcode Fuzzy Hash: abc02df14881b8553accab44fb79ef53eaa7c88a432e732f5ead529d710b0ae2
Instruction Fuzzy Hash: 7281C571A1C683A9E720EB15D8406BBA3A2FF44B84FE04035D98D47786EE3CED65C760

Function 00007FF786882180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32 ref: 00007FF7868821AB
SelectObject.GDI32 ref: 00007FF7868821F2
DrawTextW.USER32 ref: 00007FF786882215
SelectObject.GDI32 ref: 00007FF78688222B
ReleaseDC.USER32 ref: 00007FF78688223B
MoveWindow.USER32 ref: 00007FF78688228B
MoveWindow.USER32 ref: 00007FF7868822CB
MoveWindow.USER32 ref: 00007FF78688231E
MoveWindow.USER32 ref: 00007FF786882366

Strings

P%, xrefs: 00007FF7868821FF

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: aea5a987af94b89fd91d4f14867a71dc2804fc1ffbe8bcea858fbe427819369d
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 48510726614BA186D6349F26E8181BBF7A1FB98B62F104131EFDE43694DF3CD455CB20

Function 00007FF786881470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF786881518
malloc, xrefs: 00007FF78688151F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF78688149F
fread, xrefs: 00007FF7868815E6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7868814DE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7868815DF
fseek, xrefs: 00007FF7868814E5

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 3899eae9b9cf556598d50536af751799a91292f9e5d7650659be9fe1a68b4b95
Instruction ID: feb900763a8b230532dceae8de79ad601e3d16dc9fbb0a9f4766156222dcc3a8
Opcode Fuzzy Hash: 3899eae9b9cf556598d50536af751799a91292f9e5d7650659be9fe1a68b4b95
Instruction Fuzzy Hash: 11418021A18643A9EB10EB229C015BBE391BF44B98FE44432ED4D07B95EF3CED25C761

Function 00007FF786881210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF786881276
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7868812BA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF78688141E
malloc, xrefs: 00007FF7868812C1, 00007FF7868812F6
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7868812EF
1.3.1, xrefs: 00007FF786881249

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 5578c14fe94a244900e9a575e4f77a257a8de495ed559fdf9b362ebbbffb2fa7
Instruction ID: 48d92ab5e57d2e909a0196a2dc40c0e968f3a15ec074bb16271c88c7a2ad4f37
Opcode Fuzzy Hash: 5578c14fe94a244900e9a575e4f77a257a8de495ed559fdf9b362ebbbffb2fa7
Instruction Fuzzy Hash: E751D222A1864365E660BB12AC103BBE291BF85B98FE44135ED8D477D5EF3CED21C720

Function 00007FF7868836B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF786883804), ref: 00007FF7868836E1
GetLastError.KERNEL32(?,00007FF786883804), ref: 00007FF7868836EB

Part of subcall function 00007FF786882C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF786883706,?,00007FF786883804), ref: 00007FF786882C9E
Part of subcall function 00007FF786882C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF786883706,?,00007FF786883804), ref: 00007FF786882D63
Part of subcall function 00007FF786882C50: MessageBoxW.USER32 ref: 00007FF786882D99

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF786883739
Failed to convert executable path to UTF-8., xrefs: 00007FF786883790
\\?\, xrefs: 00007FF78688375A
Failed to obtain executable path., xrefs: 00007FF7868836F3
GetModuleFileNameW, xrefs: 00007FF7868836FA

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: b959de0d5084b33c3ffb6be68ab4057664d1f31ce870a0e2ad482121e6d76bce
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 6F21A751B1C642B5FE20B725EC113B7A361BF88B55FE00132D95E825D5EE2CED25C361

Function 00007FF78689BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78689BEF9

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
Instruction ID: 3fe11dfb4f17d52e7ca9e7b3a904445dc9338b43c0ac86570b593e5a383f281f
Opcode Fuzzy Hash: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
Instruction Fuzzy Hash: 65C1B52290C686A9E751AB1598402BFA766FF81B84FF54131EA4E037D1EE7CFC65C720

Function 00007FF786886350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LoadLibrary, xrefs: 00007FF78688649E
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7868863F7
Failed to load Python DLL '%ls'., xrefs: 00007FF786886497
ucrtbase.dll, xrefs: 00007FF7868863CD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF786886446
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7868863B7

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction ID: 8e6d736b6a036913ec27039f631ad4c470e59d33526330c51c9a70b3410b52a9
Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction Fuzzy Hash: 87418321A18687B1EA21FB25E8152EBA361FF54740FE00132DA5D43695EF3CED65C361

Function 00007FF786882390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7868823C8
DialogBoxIndirectParamW.USER32 ref: 00007FF78688248E
DeleteObject.GDI32 ref: 00007FF7868824C1
DestroyIcon.USER32 ref: 00007FF7868824D3

Strings

Unhandled exception in script, xrefs: 00007FF7868823F8

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: dd10c28d74256616f4f20b34f0e4914686707bcd8d030bd0fddff274f11205b5
Instruction ID: a26fd914a809d7c20ffd9d3c0fd2f471e85d74eb31464f0feffde1f652b2f9cf
Opcode Fuzzy Hash: dd10c28d74256616f4f20b34f0e4914686707bcd8d030bd0fddff274f11205b5
Instruction Fuzzy Hash: 1431723261968299EB20EF61EC552FAA360FF88788FA40135EE4D47B49EF3CD511C711

Function 00007FF786895698 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868956C5
CreateFileW.KERNEL32 ref: 00007FF786895704
CloseHandle.KERNEL32 ref: 00007FF786895739

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: 34dd8e7d0931d4145ed8793a1c6ed29c14a7d2ec580079bc391c4c5de8f72986
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: 4441B522D18782A7E711AB21995037AB360FB94764F609334EA5C03AD1EF7CB9F0C721

Function 00007FF7868820C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7868820F4
SetWindowLongPtrW.USER32 ref: 00007FF786882116
GetWindowLongPtrW.USER32 ref: 00007FF786882140
InvalidateRect.USER32 ref: 00007FF786882160

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 5f6e7416d0a87d29fee86b88f77ea6a07fef8c3c38fb3ee82fcc953a9f085559
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 9C11C625A1C14252F654A76AED5527B9292FF84B81FE44030DE4D07B89CD3DECA1C250

Function 00007FF78688CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78688CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF78688CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF78688CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF78688CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF78688CD91

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: beedc2530818bd3f20e9735d9b598f19e1bf10e76e5436f8ed69fdf564e3ff3f
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: DD313810E4824375FA64BB25DC223BB9691BF41B84FE44434E94D476DBDE2CBC25C671

Function 00007FF7868901AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868901F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868902E7

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 665c93adb0c584f00bd214158fe094e281fa43c5923644cbf4b420326caaadac
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: C251F621B0924266E764AA759C0067BE291BF44BA8FB44738DE6D437C5EF3CFC21D620

Function 00007FF78689C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF78689C33D), ref: 00007FF78689C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF78689C33D), ref: 00007FF78689C1FA

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 2dbfb5474d542de2611190ac62ffe3654f8399c72199d0216cb257f0209406b1
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 2711E761718B8191DA10AB25AC1426AE361BB45BF4FB44331EE7D4B7D9DF7CE821C700

Function 00007FF78689A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9CE
GetLastError.KERNEL32(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9D8

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 774ea465db3869487028056138b5d626f31bcc8fa99dad765c66b46427e2cb87
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 84E04F10E1860267FF147BB29C5513B92517F88741FA50030C81D422A1EE2CBCA5C320

Function 00007FF78689ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF78689AA45,?,?,00000000,00007FF78689AAFA), ref: 00007FF78689AC36
GetLastError.KERNEL32(?,?,?,00007FF78689AA45,?,?,00000000,00007FF78689AAFA), ref: 00007FF78689AC40

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 0a7110f359e1e6a0c7f033f335cff42f2b88689ea5dfbc941ec59c8e950b9473
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 4321A411B1C64261EE9077619C9027B9292BF847A4FB84235DA1E4B3C1EE6CFC65C320

Function 00007FF78689BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78689BF44

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: 8997ef36e8d08448af129c917bb73bba53ee60a7b9851b75f2aa102892bb567e
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: 6E41D6329082019BEB34AB16A94427BB3A5FB55B54FB00131DA8E436D1EF6DFC52CB71

Function 00007FF786887F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF78688802A

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: e030e723ccfde11af85d0dda47479fa887e00b1a31505a58a3447353ba43a7bb
Instruction ID: a0401811d907a02e121748e563ddec2030a19939cd3a8e8091dad5b2dace5c1f
Opcode Fuzzy Hash: e030e723ccfde11af85d0dda47479fa887e00b1a31505a58a3447353ba43a7bb
Instruction Fuzzy Hash: C121D661B49652A5FA20BA226D043BBE691BF45FD8FEC4430EE0D0F786DE7DE851C610

Function 00007FF78689B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78689BA32

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: 2641597b1bcdb6f08cf892f11f01822c6d5307bbb622eca379daa64d4c4d0e81
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: F8316D31A28642A9E7517B558C4127FA691BB40BA4FE10135E92D273D2EEBCFC61C731

Function 00007FF786896004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF786895F69

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: d5cfce93e65802c74b1b11083c1f75275c8c99e29acdeddc64114d30c52a7a43
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 61116222A1864291EA61BF11980017FE260BF45B98FE44031EB4C57A96EFBDFD60C722

Function 00007FF7868A63C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A63E7

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 675be22f4dea1f475448b76cd36bd846d34dafe06e7aa2872b1e4e170037bc1c
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 9D212972608A4297D760AF19D84077AB3A0FB80B55FB40234EA9E476D9DF3CDC60CB10

Function 00007FF78689042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF786890480

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 75912b1bf679fed69e5c81c0d616f01fe24bb1b898691c92ace4de55fb2e9e87
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 1A010861A0874150E910FF525D0106AE691BF91FE4FA84634DE5C53BD6EE3CF821C710

Function 00007FF786889070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF786889400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7868845E4,00000000,00007FF786881985), ref: 00007FF786889439

LoadLibraryExW.KERNEL32(?,00007FF786886466,?,00007FF78688336E), ref: 00007FF786889092

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction ID: ed7ea94b42d961da681919187680ae6dd76426d82f89560d1ca26905af68883a
Opcode Fuzzy Hash: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction Fuzzy Hash: 97D08C11B2424651EA94B76BBA4662A9252ABC9BC4FA88035EE1D03B4AEC3CD4618B00

Function 00007FF78689D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF786890D00,?,?,?,00007FF78689236A,?,?,?,?,?,00007FF786893B59), ref: 00007FF78689D6AA

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 017bc7437dd84b26760dbd645b9478d37f1b666bfec2f0458e8ff71825126909
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 26F03A14A0DB0265FE5676625C1127AA2907F957A0FA84230DE2E853C2EE6CBC60C974

Non-executed Functions

Function 00007FF786888BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF786889400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7868845E4,00000000,00007FF786881985), ref: 00007FF786889439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888C46

Part of subcall function 00007FF78689A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78689A500

Part of subcall function 00007FF78689878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868987F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888CD6
CreateProcessW.KERNEL32 ref: 00007FF786888D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888D18

Part of subcall function 00007FF786882C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF786883706,?,00007FF786883804), ref: 00007FF786882C9E
Part of subcall function 00007FF786882C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF786883706,?,00007FF786883804), ref: 00007FF786882D63
Part of subcall function 00007FF786882C50: MessageBoxW.USER32 ref: 00007FF786882D99

RegisterClassW.USER32 ref: 00007FF786888D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888D7B
CreateWindowExW.USER32 ref: 00007FF786888DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888E05
PeekMessageW.USER32 ref: 00007FF786888E29
TranslateMessage.USER32 ref: 00007FF786888E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888E41
PeekMessageW.USER32 ref: 00007FF786888E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786888FF4
GetExitCodeProcess.KERNEL32 ref: 00007FF786889009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF786889012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF786883F7F), ref: 00007FF78688901F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF786888D85
PyInstallerOnefileHiddenWindow, xrefs: 00007FF786888D44
Failed to create child process!, xrefs: 00007FF786888D20
CreateProcessW, xrefs: 00007FF786888D27

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: 438da8d0c0de37b86482c8b13a192400b1c9f3c284d2a92ccb293e5260d435ca
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 5CD1A531A08B82A6E710AF35EC542ABB761FF84B59FA00235DE5D47694DF3CD964C710

Function 00007FFD93B2F840 Relevance: 20.0, APIs: 2, Strings: 11, Instructions: 456COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FFD93B2FCC2
memcpy.VCRUNTIME140 ref: 00007FFD93B2FDE6

Strings

%s mode not allowed: %s, xrefs: 00007FFD93B2FD98
invalid uri authority: %.*s, xrefs: 00007FFD93B2F9C3
localhos, xrefs: 00007FFD93B2F99B
mode, xrefs: 00007FFD93B2FBB5
no such vfs: %s, xrefs: 00007FFD93B2FE95
file, xrefs: 00007FFD93B2F8C5
cach, xrefs: 00007FFD93B2FD31
cach, xrefs: 00007FFD93B2FBA6
no such %s mode: %s, xrefs: 00007FFD93B2FCEE
access, xrefs: 00007FFD93B2FC84
cache, xrefs: 00007FFD93B2FC59

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcmpmemcpy
String ID: %s mode not allowed: %s$access$cach$cach$cache$file$invalid uri authority: %.*s$localhos$mode$no such %s mode: %s$no such vfs: %s
API String ID: 1784268899-1330295256
Opcode ID: dc9c8d5d3580681435808636d4fadb7b35fdaa8ccab8ab5a4871f2b3615016fe
Instruction ID: 0c629a89bc3c2f1ab60d574c9f3d7472c7c934204a329022436900c4df963075
Opcode Fuzzy Hash: dc9c8d5d3580681435808636d4fadb7b35fdaa8ccab8ab5a4871f2b3615016fe
Instruction Fuzzy Hash: BD02F062F0C28245FB758BA5D4743796B99EB21BA8F044335DBEE666C5DE3CE8458300

Function 00007FFD93BE18A0 Relevance: 13.9, APIs: 9, Instructions: 426COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312 ref: 00007FFD93BE1903
PyType_IsSubtype.PYTHON312 ref: 00007FFD93BE19F6
PyType_IsSubtype.PYTHON312 ref: 00007FFD93BE1A53
PyUnicode_FromKindAndData.PYTHON312 ref: 00007FFD93BE1B24
PyMem_Free.PYTHON312 ref: 00007FFD93BE1B32
PyMem_Realloc.PYTHON312 ref: 00007FFD93BE1C1B
PyMem_Free.PYTHON312 ref: 00007FFD93BE3A2D
PyErr_NoMemory.PYTHON312 ref: 00007FFD93BE3A33

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Mem_$FreeSubtypeType_$DataErr_FromKindMallocMemoryReallocUnicode_
String ID:
API String ID: 3719493655-0
Opcode ID: 13b0b1041cca574ca06701db0d45e779ed743a60764eb712a04665505c58f9af
Instruction ID: 91c3215af6e20caa2efaeade862bf951bc6a3a5d40948e22c7f02787a4a32d3c
Opcode Fuzzy Hash: 13b0b1041cca574ca06701db0d45e779ed743a60764eb712a04665505c58f9af
Instruction Fuzzy Hash: EF020472B0C59282E7348B9DD46467D37A9FB84788F684131D6DEA6780EF3CE840C782

Function 00007FFD93A9C720 Relevance: 13.9, APIs: 1, Strings: 8, Instructions: 403COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93A9C844

Strings

Page %u: pointer map referenced, xrefs: 00007FFD93A9CB94
Page %u: never used, xrefs: 00007FFD93A9CB28
incremental_vacuum enabled with a max rootpage of zero, xrefs: 00007FFD93A9C960
Bad ptr map entry key=%u expected=(%u,%u) got=(%u,%u), xrefs: 00007FFD93A9CA38
Freelist: , xrefs: 00007FFD93A9C8BA
max rootpage (%u) disagrees with header (%u), xrefs: 00007FFD93A9C93C
Failed to read ptrmap key=%u, xrefs: 00007FFD93A9CA11
3|r<, xrefs: 00007FFD93A9C73C

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memset
String ID: 3|r<$Bad ptr map entry key=%u expected=(%u,%u) got=(%u,%u)$Failed to read ptrmap key=%u$Freelist: $Page %u: never used$Page %u: pointer map referenced$incremental_vacuum enabled with a max rootpage of zero$max rootpage (%u) disagrees with header (%u)
API String ID: 2221118986-3000184473
Opcode ID: ba183b6814ddd736a71aeb774c7d47a38622bcc163b2f6dde4c5f696381e8954
Instruction ID: 1422967cbb06367991337db08c66bc6bde6e66f4e617159cccad57ad6cc55781
Opcode Fuzzy Hash: ba183b6814ddd736a71aeb774c7d47a38622bcc163b2f6dde4c5f696381e8954
Instruction Fuzzy Hash: D302AF76F08A418AE734CBA9D46427D77A9FB84748F14413ADA8E67B94DF3CE840CB40

Function 00007FFD9E851960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFD9E85197C
memset.VCRUNTIME140 ref: 00007FFD9E8519A0
RtlCaptureContext.KERNEL32 ref: 00007FFD9E8519A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFD9E8519C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFD9E851A04
memset.VCRUNTIME140 ref: 00007FFD9E851A37
IsDebuggerPresent.KERNEL32 ref: 00007FFD9E851A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFD9E851A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFD9E851A84

Memory Dump Source

Source File: 00000002.00000002.3398881311.00007FFD9E851000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FFD9E850000, based on PE: true

Associated: 00000002.00000002.3398785576.00007FFD9E850000.00000002.00000001.01000000.00000028.sdmpDownload File
Associated: 00000002.00000002.3398898607.00007FFD9E854000.00000002.00000001.01000000.00000028.sdmpDownload File
Associated: 00000002.00000002.3398913456.00007FFD9E855000.00000004.00000001.01000000.00000028.sdmpDownload File
Associated: 00000002.00000002.3398946159.00007FFD9E856000.00000002.00000001.01000000.00000028.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9e850000_shost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 0a57d354b9f48531f5e4b6dcb676abd35c4c55538187d76e763eeca891f7d0db
Instruction ID: 054c1795412b58f5ff7415cb8ae9f2742f742cedf30e6d086934c8130481ff81
Opcode Fuzzy Hash: 0a57d354b9f48531f5e4b6dcb676abd35c4c55538187d76e763eeca891f7d0db
Instruction Fuzzy Hash: DC312D72709B8189EB709FE0E8A03ED7364FB84744F54447ADA4E47A99DF38D648C760

Function 00007FFD9E841960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFD9E84197C
memset.VCRUNTIME140 ref: 00007FFD9E8419A0
RtlCaptureContext.KERNEL32 ref: 00007FFD9E8419A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFD9E8419C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFD9E841A04
memset.VCRUNTIME140 ref: 00007FFD9E841A37
IsDebuggerPresent.KERNEL32 ref: 00007FFD9E841A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFD9E841A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFD9E841A84

Memory Dump Source

Source File: 00000002.00000002.3398726014.00007FFD9E841000.00000020.00000001.01000000.00000029.sdmp, Offset: 00007FFD9E840000, based on PE: true

Associated: 00000002.00000002.3398673718.00007FFD9E840000.00000002.00000001.01000000.00000029.sdmpDownload File
Associated: 00000002.00000002.3398743429.00007FFD9E846000.00000002.00000001.01000000.00000029.sdmpDownload File
Associated: 00000002.00000002.3398761417.00007FFD9E84B000.00000002.00000001.01000000.00000029.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9e840000_shost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 26897df24f70a55c30b919b36952ff972a20fdcb0ee0bee13c52e1828fe953fd
Instruction ID: a9f5aec6640f3cc03c8682a5e30e6605b27fee00270b65bc5afa76e591679880
Opcode Fuzzy Hash: 26897df24f70a55c30b919b36952ff972a20fdcb0ee0bee13c52e1828fe953fd
Instruction Fuzzy Hash: 7B312D72709B8189EB709FE0E8A07ED7364FB88744F44453ADA4E57A94EF38D648C720

Function 00007FFDA32F1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDA32F197C
memset.VCRUNTIME140 ref: 00007FFDA32F19A0
RtlCaptureContext.KERNEL32 ref: 00007FFDA32F19A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDA32F19C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFDA32F1A04
memset.VCRUNTIME140 ref: 00007FFDA32F1A37
IsDebuggerPresent.KERNEL32 ref: 00007FFDA32F1A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDA32F1A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDA32F1A84

Memory Dump Source

Source File: 00000002.00000002.3399773954.00007FFDA32F1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDA32F0000, based on PE: true

Associated: 00000002.00000002.3399757109.00007FFDA32F0000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000002.00000002.3399790328.00007FFDA32F3000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000002.00000002.3399805937.00007FFDA32F4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000002.00000002.3399820426.00007FFDA32F5000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda32f0000_shost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction ID: 1ce7a5f6019f69b6f0fb4cf2ee23215719ee90cad8ac3e695b7a0f1fd7679b29
Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction Fuzzy Hash: 26315E7270AA81CAEB649F60E8607E97361FB84744F84403ADB8E57B89DF39D558C708

Function 00007FFDA3531960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFDA353197C
memset.VCRUNTIME140 ref: 00007FFDA35319A0
RtlCaptureContext.KERNEL32 ref: 00007FFDA35319A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFDA35319C3
RtlVirtualUnwind.KERNEL32 ref: 00007FFDA3531A04
memset.VCRUNTIME140 ref: 00007FFDA3531A37
IsDebuggerPresent.KERNEL32 ref: 00007FFDA3531A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDA3531A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDA3531A84

Memory Dump Source

Source File: 00000002.00000002.3399927928.00007FFDA3531000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FFDA3530000, based on PE: true

Associated: 00000002.00000002.3399906871.00007FFDA3530000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399946107.00007FFDA3533000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399964219.00007FFDA3534000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399983040.00007FFDA3535000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3530000_shost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction ID: e1d140e2d91dce6ef3868b8ba04d7d7eec9d4e59f9a7a0bde5aa5b72a0c079be
Opcode Fuzzy Hash: f8ae4d2eff8d27b3a0b7405f1d7147d7316b9bc7e7709510c05685c771672a79
Instruction Fuzzy Hash: 15319072B0AB8189EB659F64E8603ED3361FB84344F44483ADA8E53B85DF3DD648C718

Function 00007FFD93A7E980 Relevance: 12.4, APIs: 2, Strings: 6, Instructions: 399COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93A7E9EB
memset.VCRUNTIME140 ref: 00007FFD93A7EA73

Part of subcall function 00007FFD93A7C090: memset.VCRUNTIME140 ref: 00007FFD93A7C0F2

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, xrefs: 00007FFD93A7EC93
winGetTempname1, xrefs: 00007FFD93A7EB74
winGetTempname4, xrefs: 00007FFD93A7EF1E
winGetTempname5, xrefs: 00007FFD93A7EC4C
etilqs_, xrefs: 00007FFD93A7E9A2, 00007FFD93A7EC5A
winGetTempname2, xrefs: 00007FFD93A7EAA6

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memset
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789$etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 2221118986-463513059
Opcode ID: f78114a871995769fda7b6e9c41417a2f13788b9671d04a7951bcf123021d595
Instruction ID: 61c8d3d2b4079ca63c5d07f8e6896479f3fe310a2eae1c4fa3356f58761e8f29
Opcode Fuzzy Hash: f78114a871995769fda7b6e9c41417a2f13788b9671d04a7951bcf123021d595
Instruction Fuzzy Hash: F9E15451F1C3CA47EE2C8B79A4B55386B98AB55788F48813ADAAF437D2DE2CF511C300

Function 00007FFD93AE9A70 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 398COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93AEA018

Strings

misuse, xrefs: 00007FFD93AE9AE2
invalid, xrefs: 00007FFD93AE9AB2
unopened, xrefs: 00007FFD93AE9ABD
%s at line %d of [%.10s], xrefs: 00007FFD93AE9AEE
NULL, xrefs: 00007FFD93AE9A9D
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93AE9AD5
API call with %s database connection pointer, xrefs: 00007FFD93AE9AC4

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 3510742995-863375387
Opcode ID: ebcfd4d320c8a855c25bad2e79043b46f1baa289721c4d7e74e567b371a0d908
Instruction ID: 0e3852c79b28793eba0dafd391e0d5dc65704c89c1c6f768cc4b2a0a59f25336
Opcode Fuzzy Hash: ebcfd4d320c8a855c25bad2e79043b46f1baa289721c4d7e74e567b371a0d908
Instruction Fuzzy Hash: C002B322B0978285EB749B96D4703BE67AAFF84B88F544139DE8E67795DF3CE4418300

Function 00007FF7868883B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF786888B09,00007FF786883FA5), ref: 00007FF78688841B
RemoveDirectoryW.KERNEL32(?,00007FF786888B09,00007FF786883FA5), ref: 00007FF78688849E
DeleteFileW.KERNEL32(?,00007FF786888B09,00007FF786883FA5), ref: 00007FF7868884BD
FindNextFileW.KERNEL32(?,00007FF786888B09,00007FF786883FA5), ref: 00007FF7868884CB
FindClose.KERNEL32(?,00007FF786888B09,00007FF786883FA5), ref: 00007FF7868884DC
RemoveDirectoryW.KERNEL32(?,00007FF786888B09,00007FF786883FA5), ref: 00007FF7868884E5

Strings

%s\*, xrefs: 00007FF7868883E2

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: ded52e21894fb40567f0cd365215e39380ed7354b0157a87048cd12689cfa2aa
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: AF41A062A0C943A5EA30BB21EC445BBA3A5FF94B50FE00232D99D466C4DF3CED56C720

Function 00007FFD93AF1850 Relevance: 10.9, APIs: 3, Strings: 4, Instructions: 369COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93AF18BF

Strings

statement too long, xrefs: 00007FFD93AF1A76
database schema is locked: %s, xrefs: 00007FFD93AF1A16
out of memory, xrefs: 00007FFD93AF192B
3|r<, xrefs: 00007FFD93AF186C

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memset
String ID: 3|r<$database schema is locked: %s$out of memory$statement too long
API String ID: 2221118986-1562815132
Opcode ID: b968ee7f529514d3c8785df9b5e5e7d59bf4ad24483beab919f2932cdee82f83
Instruction ID: f45ba0c32c624c7c71c729eb756dbbdd40bf7557bdec3a2524b37f38970956a3
Opcode Fuzzy Hash: b968ee7f529514d3c8785df9b5e5e7d59bf4ad24483beab919f2932cdee82f83
Instruction Fuzzy Hash: BAF1A022B0878286EB34CFA1D4647BA67A8FF95B88F080135DA8E27795DF7CE441C740

Function 00007FFD93BE12F0 Relevance: 10.8, APIs: 7, Instructions: 347COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD93BE18A0: PyMem_Malloc.PYTHON312 ref: 00007FFD93BE1903
Part of subcall function 00007FFD93BE18A0: PyType_IsSubtype.PYTHON312 ref: 00007FFD93BE19F6
Part of subcall function 00007FFD93BE18A0: PyType_IsSubtype.PYTHON312 ref: 00007FFD93BE1A53

PyMem_Malloc.PYTHON312 ref: 00007FFD93BE1377
PyMem_Free.PYTHON312 ref: 00007FFD93BE1487
PyErr_NoMemory.PYTHON312 ref: 00007FFD93BE38AD
_Py_Dealloc.PYTHON312 ref: 00007FFD93BE38C4

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
String ID:
API String ID: 4139299733-0
Opcode ID: 4c1ab3a9ee10578f50e5ddcb80cbb1500edbf8f85856d8ea69ee8be7dac4cd66
Instruction ID: f0a64276e313d1ecf9494651b95a502ebdf7f172568ee30ac42083f63043fe32
Opcode Fuzzy Hash: 4c1ab3a9ee10578f50e5ddcb80cbb1500edbf8f85856d8ea69ee8be7dac4cd66
Instruction Fuzzy Hash: A8E1BFB2F1C55281EB348B99D03467D37ADFB45798F640235DADEA2780DE2CE941C782

Function 00007FF78688D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF78688D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF78688D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78688D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF78688D240
IsDebuggerPresent.KERNEL32 ref: 00007FF78688D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78688D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78688D2BC

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: 9d75b1113054d2fb331f7db43c923384e283103b4617b015ac9b0d72fb6b7c38
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 21315372608B819AEB609F61EC803EEB361FB88745F94403ADA4D47B95DF3CD958C720

Function 00007FFD93A76948 Relevance: 9.4, APIs: 2, Strings: 4, Instructions: 441COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00007FFD93A76C09
-x0, xrefs: 00007FFD93A76C7F
VUUU, xrefs: 00007FFD93A76AE7
0123456789ABCDEF0123456789abcdef, xrefs: 00007FFD93A76B9C

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID:
String ID: -x0$0123456789ABCDEF0123456789abcdef$VUUU$VUUU
API String ID: 0-2031831958
Opcode ID: 3d34d0e7b00230b3be4a4963189f5afe2a8e6f33793eb41f9f926aece0841a0b
Instruction ID: 0d0e3668134b41a10db7971de6157f0e44b7b82f8730653c495132bc45561b6f
Opcode Fuzzy Hash: 3d34d0e7b00230b3be4a4963189f5afe2a8e6f33793eb41f9f926aece0841a0b
Instruction Fuzzy Hash: 3A02E622F0C68689DB758B6990A47BA7BA9FF85788F044135DA8FA3766DF2CD441C700

Function 00007FF7868A5C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7868A5CB5

Part of subcall function 00007FF7868A5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A561C

Part of subcall function 00007FF78689A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9CE
Part of subcall function 00007FF78689A9B8: GetLastError.KERNEL32(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9D8

Part of subcall function 00007FF78689A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF78689A94F,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689A979
Part of subcall function 00007FF78689A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF78689A94F,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689A99E

_get_daylight.LIBCMT ref: 00007FF7868A5CA4

Part of subcall function 00007FF7868A5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A567C

_get_daylight.LIBCMT ref: 00007FF7868A5F1A
_get_daylight.LIBCMT ref: 00007FF7868A5F2B
_get_daylight.LIBCMT ref: 00007FF7868A5F3C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7868A617C), ref: 00007FF7868A5F63

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
Instruction ID: f269eb636b40f83b90217a0a694437bb284b441e3b7b8fbbe173de4a4873b2e5
Opcode Fuzzy Hash: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
Instruction Fuzzy Hash: DDD1E522A0820266E721BF22DC515BBA752FF44795FE48135DE0D47A85EF3CECA1C362

Function 00007FF78689A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF78689A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78689A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF78689A750
IsDebuggerPresent.KERNEL32 ref: 00007FF78689A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78689A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78689A79E

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: 6d4fd482c85bd7a40884fcf087a0e9f48c4e323a183cd58a4507cfbaac2abe28
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: 10316436618B8196D760DF25EC402AFB3A4FB88754FA40136EA8D43B58EF3CD555CB10

Function 00007FF7868A18E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A1930
FindFirstFileExW.KERNEL32 ref: 00007FF7868A1A3A

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
Instruction ID: 64cdd60047b320c9d8144e239ccdc5194dddd32b31bbcd7269d75422acd347b7
Opcode Fuzzy Hash: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
Instruction Fuzzy Hash: 6CB1A422B1869251EA60AB629D001BBE3A1FB44BE5FE45131DE9D17BC5EF3CEC61C311

Function 00007FFD93A962C0 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93A96452
memset.VCRUNTIME140 ref: 00007FFD93A96463
memcpy.VCRUNTIME140 ref: 00007FFD93A964D8
memcpy.VCRUNTIME140 ref: 00007FFD93A964F0
memset.VCRUNTIME140 ref: 00007FFD93A964FF

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 304fba770c544ede7452a4061ca79efafbc2549250430ea71847b1f8e5c244b1
Instruction ID: a1718316abb965b48a96b5753b6f498a638f6c09250ee14b6ee58b39d693a099
Opcode Fuzzy Hash: 304fba770c544ede7452a4061ca79efafbc2549250430ea71847b1f8e5c244b1
Instruction Fuzzy Hash: E7E1E2327087818AE7A08F65D0607BD67A9FB59BD4F048036EE4E637A5DE3DE4458300

Function 00007FFD93A8B310 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 365COMMON

Download Yara Rule

Strings

recovered %d frames from WAL file %s, xrefs: 00007FFD93A8B83F
3|r<, xrefs: 00007FFD93A8B31E
, xrefs: 00007FFD93A8B3A2

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID:
String ID: $3|r<$recovered %d frames from WAL file %s
API String ID: 0-1402342672
Opcode ID: e861627ede029ef82ed544f90b725bedb9688ef63eb3848f841ee36d924a6481
Instruction ID: 94dfe0811a62041711153cc370d5a605537d67f24a8959077a008794e658ae62
Opcode Fuzzy Hash: e861627ede029ef82ed544f90b725bedb9688ef63eb3848f841ee36d924a6481
Instruction Fuzzy Hash: B1F17C32B0878687E7709F69E05076E77A5FB84B88F114035DA8E97B58DF38E845CB40

Function 00007FFD93A8BB70 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93A8BBCD
memcpy.VCRUNTIME140 ref: 00007FFD93A8BCA6
memcpy.VCRUNTIME140 ref: 00007FFD93A8BDC1

Strings

3|r<, xrefs: 00007FFD93A8BB87

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy$memset
String ID: 3|r<
API String ID: 438689982-173920056
Opcode ID: 0a3d5c46c7ca0ff3dbcdf92da49a220ed4c5ea0f1776636bee938e1d01fe2379
Instruction ID: 137230afb533b4de8bdf72114d573d705731c50e1cc45c25da2d7fcd0b75edab
Opcode Fuzzy Hash: 0a3d5c46c7ca0ff3dbcdf92da49a220ed4c5ea0f1776636bee938e1d01fe2379
Instruction Fuzzy Hash: 8D7114B2B0869597DA30DF85E0602BA77A5F798B88F845136EB8E13745EF3CE551C700

Function 00007FF7868A5EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7868A5F1A

Part of subcall function 00007FF7868A5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A567C

_get_daylight.LIBCMT ref: 00007FF7868A5F2B

Part of subcall function 00007FF7868A5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A561C

_get_daylight.LIBCMT ref: 00007FF7868A5F3C

Part of subcall function 00007FF7868A5638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A564C

Part of subcall function 00007FF78689A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9CE
Part of subcall function 00007FF78689A9B8: GetLastError.KERNEL32(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7868A617C), ref: 00007FF7868A5F63

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction ID: d85df6983de4796410c255be07c94f9412824f40e8ee58feaf04f3c59d629aad
Opcode Fuzzy Hash: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction Fuzzy Hash: FF51C631A08642A6E750FF32EC915ABE761BB48785FE04135DE0D43A96DF3CE8A1C761

Function 00007FFD9E852EB0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 283COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFD9E852F23

Strings

OCB_ENCRYPT==direction || OCB_DECRYPT==direction, xrefs: 00007FFD9E852F1C
src/raw_ocb.c, xrefs: 00007FFD9E852F15

Memory Dump Source

Source File: 00000002.00000002.3398881311.00007FFD9E851000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FFD9E850000, based on PE: true

Associated: 00000002.00000002.3398785576.00007FFD9E850000.00000002.00000001.01000000.00000028.sdmpDownload File
Associated: 00000002.00000002.3398898607.00007FFD9E854000.00000002.00000001.01000000.00000028.sdmpDownload File
Associated: 00000002.00000002.3398913456.00007FFD9E855000.00000004.00000001.01000000.00000028.sdmpDownload File
Associated: 00000002.00000002.3398946159.00007FFD9E856000.00000002.00000001.01000000.00000028.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9e850000_shost.jbxd

Similarity

API ID: _wassert
String ID: OCB_ENCRYPT==direction || OCB_DECRYPT==direction$src/raw_ocb.c
API String ID: 3234217646-1106498308
Opcode ID: 96f1c7f081ec5b5f110a8a436ffb5769e61779f6ca8b250aca86d5a0fd4485a4
Instruction ID: 8bea2851e0bdfec3e2aa945531b822ce75ff5251020bfa4cdc338780061966b2
Opcode Fuzzy Hash: 96f1c7f081ec5b5f110a8a436ffb5769e61779f6ca8b250aca86d5a0fd4485a4
Instruction Fuzzy Hash: 56E1294210D6D008C7168FB590206FE7FF0DB5FA59F4D81B6EBE94E58BD908C254EB2A

Function 00007FF786885820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF786885830
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF786885842
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF786885879
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF78688588B
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868858A4
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868858B6
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868858CF
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868858E1
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868858FD
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF78688590F
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF78688592B
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF78688593D
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF786885959
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF78688596B
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF786885987
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF786885999
GetProcAddress.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868859B5
GetLastError.KERNEL32(?,00007FF7868864BF,?,00007FF78688336E), ref: 00007FF7868859C7

Strings

PyObject_Str, xrefs: 00007FF786885D9F, 00007FF786885DC1
PyErr_NormalizeException, xrefs: 00007FF786885AED, 00007FF786885B0F
PyEval_EvalCode, xrefs: 00007FF786885BA5, 00007FF786885BC7
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF786885DCD, 00007FF786885DEF
PyRun_SimpleStringFlags, xrefs: 00007FF786885DFB, 00007FF786885E1D
Py_ExitStatusException, xrefs: 00007FF78688589A, 00007FF7868858BC
PySys_SetObject, xrefs: 00007FF786885E85, 00007FF786885EA7
PyErr_Occurred, xrefs: 00007FF786885B1B, 00007FF786885B3D
Failed to get address for %hs, xrefs: 00007FF786885851
PyConfig_InitIsolatedConfig, xrefs: 00007FF7868859AB, 00007FF7868859CD
Py_IsInitialized, xrefs: 00007FF786885921, 00007FF786885943
Py_InitializeFromConfig, xrefs: 00007FF7868858F3, 00007FF786885915
PyErr_Fetch, xrefs: 00007FF786885ABF, 00007FF786885AE1
PyConfig_SetWideStringList, xrefs: 00007FF786885A63, 00007FF786885A85
PyUnicode_DecodeFSDefault, xrefs: 00007FF786885F0F, 00007FF786885F31
PyUnicode_Replace, xrefs: 00007FF786885FC7, 00007FF786885FE9
PyImport_ExecCodeModule, xrefs: 00007FF786885C01, 00007FF786885C23
PyErr_Clear, xrefs: 00007FF786885A91, 00007FF786885AB3
Py_Finalize, xrefs: 00007FF7868858C5, 00007FF7868858E7
PyConfig_Read, xrefs: 00007FF7868859D9, 00007FF7868859FB
Py_DecodeLocale, xrefs: 00007FF78688586F, 00007FF786885891
PyErr_Restore, xrefs: 00007FF786885B77, 00007FF786885B99
Py_PreInitialize, xrefs: 00007FF78688594F, 00007FF786885971
PyImport_ImportModule, xrefs: 00007FF786885C2F, 00007FF786885C51
Py_DecRef, xrefs: 00007FF786885826, 00007FF786885848
PyObject_CallFunction, xrefs: 00007FF786885CE7, 00007FF786885D09
PyUnicode_FromFormat, xrefs: 00007FF786885F3D, 00007FF786885F5F
PyModule_GetDict, xrefs: 00007FF786885CB9, 00007FF786885CDB
PyObject_GetAttrString, xrefs: 00007FF786885D43, 00007FF786885D65
PyConfig_Clear, xrefs: 00007FF78688597D, 00007FF78688599F
PyUnicode_Join, xrefs: 00007FF786885F99, 00007FF786885FBB
PyMem_RawFree, xrefs: 00007FF786885C8B, 00007FF786885CAD
PyUnicode_AsUTF8, xrefs: 00007FF786885EB3, 00007FF786885ED5
PyStatus_Exception, xrefs: 00007FF786885E29, 00007FF786885E4B
PyUnicode_Decode, xrefs: 00007FF786885EE1, 00007FF786885F03
PyConfig_SetBytesString, xrefs: 00007FF786885A07, 00007FF786885A29
PyUnicode_FromString, xrefs: 00007FF786885F6B, 00007FF786885F8D
PySys_GetObject, xrefs: 00007FF786885E57, 00007FF786885E79
GetProcAddress, xrefs: 00007FF786885858
PyErr_Print, xrefs: 00007FF786885B49, 00007FF786885B6B
PyConfig_SetString, xrefs: 00007FF786885A35, 00007FF786885A57
PyImport_AddModule, xrefs: 00007FF786885BD3, 00007FF786885BF5
PyObject_CallFunctionObjArgs, xrefs: 00007FF786885D15, 00007FF786885D37
PyObject_SetAttrString, xrefs: 00007FF786885D71, 00007FF786885D93
PyMarshal_ReadObjectFromString, xrefs: 00007FF786885C5D, 00007FF786885C7F

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: ce75427a784e0e5f74f45ae2c3caa6ddfef49f28481a8729d3e78feca5847dff
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: 34229524A49B47B5FA95BB56AD50277A3A1BF04B56FE41035CC1E02360EF7CED78C222

Function 00007FF7868876B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7868876C7
GetLastError.KERNEL32 ref: 00007FF7868876D9
GetProcAddress.KERNEL32 ref: 00007FF786887715
GetLastError.KERNEL32 ref: 00007FF786887727
GetProcAddress.KERNEL32 ref: 00007FF786887740
GetLastError.KERNEL32 ref: 00007FF786887752
GetProcAddress.KERNEL32 ref: 00007FF78688776B
GetLastError.KERNEL32 ref: 00007FF78688777D
GetProcAddress.KERNEL32 ref: 00007FF786887799
GetLastError.KERNEL32 ref: 00007FF7868877AB
GetProcAddress.KERNEL32 ref: 00007FF7868877C7
GetLastError.KERNEL32 ref: 00007FF7868877D9
GetProcAddress.KERNEL32 ref: 00007FF7868877F5
GetLastError.KERNEL32 ref: 00007FF786887807
GetProcAddress.KERNEL32 ref: 00007FF786887823
GetLastError.KERNEL32 ref: 00007FF786887835
GetProcAddress.KERNEL32 ref: 00007FF786887851
GetLastError.KERNEL32 ref: 00007FF786887863

Strings

Tcl_DeleteInterp, xrefs: 00007FF7868877EB, 00007FF78688780D
Tcl_FindExecutable, xrefs: 00007FF786887736, 00007FF786887758
Tcl_ConditionWait, xrefs: 00007FF786887989, 00007FF7868879AB
Tcl_EvalObjv, xrefs: 00007FF786887BDF, 00007FF786887C01
Tcl_CreateInterp, xrefs: 00007FF78688770B, 00007FF78688772D
Failed to get address for %hs, xrefs: 00007FF7868876E8
Tcl_Alloc, xrefs: 00007FF786887C0D, 00007FF786887C2F
Tcl_ConditionFinalize, xrefs: 00007FF78688792D, 00007FF78688794F
Tcl_NewStringObj, xrefs: 00007FF786887ACB, 00007FF786887AED
Tcl_Free, xrefs: 00007FF786887C3B, 00007FF786887C5D
Tcl_Finalize, xrefs: 00007FF78688778F, 00007FF7868877B1
Tcl_NewByteArrayObj, xrefs: 00007FF786887AF9, 00007FF786887B1B
Tk_Init, xrefs: 00007FF786887C69, 00007FF786887C8B
Tcl_DoOneEvent, xrefs: 00007FF786887761, 00007FF786887783
Tcl_GetCurrentThread, xrefs: 00007FF786887847, 00007FF786887869
Tcl_SetVar2, xrefs: 00007FF786887A41, 00007FF786887A63
Tcl_SetVar2Ex, xrefs: 00007FF786887B27, 00007FF786887B49
Tcl_JoinThread, xrefs: 00007FF786887875, 00007FF786887897
Tcl_GetVar2, xrefs: 00007FF786887A13, 00007FF786887A35
Tcl_Init, xrefs: 00007FF7868876C0, 00007FF7868876DF
Tcl_EvalFile, xrefs: 00007FF786887B83, 00007FF786887BA5
Tcl_MutexLock, xrefs: 00007FF7868878A3, 00007FF7868878C5
Tcl_ThreadAlert, xrefs: 00007FF7868879E5, 00007FF786887A07
Tk_GetNumMainWindows, xrefs: 00007FF786887C97, 00007FF786887CB9
Tcl_FinalizeThread, xrefs: 00007FF7868877BD, 00007FF7868877DF
Tcl_GetObjResult, xrefs: 00007FF786887B55, 00007FF786887B77
Tcl_CreateObjCommand, xrefs: 00007FF786887A6F, 00007FF786887A91
Tcl_CreateThread, xrefs: 00007FF786887819, 00007FF78688783B
Tcl_ConditionNotify, xrefs: 00007FF78688795B, 00007FF78688797D
Tcl_EvalEx, xrefs: 00007FF786887BB1, 00007FF786887BD3
Tcl_GetString, xrefs: 00007FF786887A9D, 00007FF786887ABF
Tcl_MutexUnlock, xrefs: 00007FF7868878D1, 00007FF7868878F3
Tcl_MutexFinalize, xrefs: 00007FF7868878FF, 00007FF786887921
Tcl_ThreadQueueEvent, xrefs: 00007FF7868879B7, 00007FF7868879D9
GetProcAddress, xrefs: 00007FF7868876EF

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: b7e6c0f7080c5394b129f1579ef3379d0b18bf695f598663895e5abb30fe5253
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 7C02A42090DB07B4EA54BB56AD505BBA361BF04B56FF41031D95E422A0EF7CFD68C232

Function 00007FFD93B1FEF0 Relevance: 27.2, APIs: 1, Strings: 17, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD93ABB0F0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,00007FFD93B25B2A,?,?,?,?,?,00007FFD93ABAE92), ref: 00007FFD93ABB298

Part of subcall function 00007FFD93ABABE0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FFD93AB532C), ref: 00007FFD93ABAD4A
Part of subcall function 00007FFD93ABABE0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FFD93AB532C), ref: 00007FFD93ABADD6

memcpy.VCRUNTIME140 ref: 00007FFD93B20272

Strings

row_number, xrefs: 00007FFD93B2003A
U, xrefs: 00007FFD93B200AF
Y, xrefs: 00007FFD93B200B7
3|r<, xrefs: 00007FFD93B1FF07
ntile, xrefs: 00007FFD93B20089
U, xrefs: 00007FFD93B200C7
L, xrefs: 00007FFD93B20050
lead, xrefs: 00007FFD93B20094
cume_dist, xrefs: 00007FFD93B2007E
rank, xrefs: 00007FFD93B20060
percent_rank, xrefs: 00007FFD93B20073
Z, xrefs: 00007FFD93B200BF
dense_rank, xrefs: 00007FFD93B20049
RANGE with offset PRECEDING/FOLLOWING requires one ORDER BY expression, xrefs: 00007FFD93B1FFF7
lag, xrefs: 00007FFD93B2009F
FILTER clause may only be used with aggregate window functions, xrefs: 00007FFD93B20022
Z, xrefs: 00007FFD93B20067

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: 3|r<$FILTER clause may only be used with aggregate window functions$L$RANGE with offset PRECEDING/FOLLOWING requires one ORDER BY expression$U$U$Y$Z$Z$cume_dist$dense_rank$lag$lead$ntile$percent_rank$rank$row_number
API String ID: 3510742995-1130053682
Opcode ID: d0f794e3eba2dab1105ba4e45b31467616ee0780e0801c169732da2678dcebd2
Instruction ID: 808a17be3f3827ad8054610119396dc32bb9a27030f7b8cd725cea2097591f2a
Opcode Fuzzy Hash: d0f794e3eba2dab1105ba4e45b31467616ee0780e0801c169732da2678dcebd2
Instruction Fuzzy Hash: 4CB16C72B09B819AE770CFA5D86026A37A9FB59748F004235DB9D17B95DF7CE064CB00

Function 00007FF7868881C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF786889400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7868845E4,00000000,00007FF786881985), ref: 00007FF786889439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7868888A7,?,?,00000000,00007FF786883CBB), ref: 00007FF78688821C

Part of subcall function 00007FF786882810: MessageBoxW.USER32 ref: 00007FF7868828EA

Strings

LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7868882C9
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF78688828D
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF786888363
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF786888230
%.*s, xrefs: 00007FF7868882FC
CreateDirectory, xrefs: 00007FF78688836C
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7868881F3
\, xrefs: 00007FF786888251

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 6fbdb188916104b0c2c5940302cfd80688c9116ecc918f500a0c860990a20752
Instruction ID: dab16422224a87450ab669de7dcf317e36ac18fc6b551cc608f837afce2e92d5
Opcode Fuzzy Hash: 6fbdb188916104b0c2c5940302cfd80688c9116ecc918f500a0c860990a20752
Instruction Fuzzy Hash: 6051B851A18642B5FB60FB25EC512BBE291FF94B81FE44031DA0E866D5EF2CEC24C760

Function 00007FF786881600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

Failed to create symbolic link %s!, xrefs: 00007FF786881622
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF786881742
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7868817CA
Failed to extract %s: failed to open target file!, xrefs: 00007FF78688165C
malloc, xrefs: 00007FF786881749
fwrite, xrefs: 00007FF7868817D1
fopen, xrefs: 00007FF786881663
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7868816A2
fread, xrefs: 00007FF7868817E6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7868816DA
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7868817DF
fseek, xrefs: 00007FF7868816E1

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 0a87ee3060ec78e21d6c2d3bfc048a27d307e8fd5641d8a78f43b3b0b6daa239
Instruction ID: 1ffdf0340a463e01c4bc35ad65cebf53aa21542038603b3c6465b969e06ec171
Opcode Fuzzy Hash: 0a87ee3060ec78e21d6c2d3bfc048a27d307e8fd5641d8a78f43b3b0b6daa239
Instruction Fuzzy Hash: 3151AE21B18643A6EA10BB129C015ABE3A1BF44B94FE44135EE8C47796EF3CFD65C760

Function 00007FFDA32F2650 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA32F26F7
_aligned_malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA32F2726
_aligned_free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA32F27F8
_aligned_free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA32F2807
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA32F2810
_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA32F28A4

Strings

src/raw_ctr.c, xrefs: 00007FFDA32F287B
block_len < 256, xrefs: 00007FFDA32F2882
src/raw_ctr.c, xrefs: 00007FFDA32F2896
block_len > 0, xrefs: 00007FFDA32F289D

Memory Dump Source

Source File: 00000002.00000002.3399773954.00007FFDA32F1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDA32F0000, based on PE: true

Associated: 00000002.00000002.3399757109.00007FFDA32F0000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000002.00000002.3399790328.00007FFDA32F3000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000002.00000002.3399805937.00007FFDA32F4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000002.00000002.3399820426.00007FFDA32F5000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda32f0000_shost.jbxd

Similarity

API ID: _aligned_free$_aligned_malloc_wassertcallocfree
String ID: block_len < 256$block_len > 0$src/raw_ctr.c$src/raw_ctr.c
API String ID: 592997318-2016502466
Opcode ID: 0feb0811099df3945d27071898244650c3f4633db531f857b0110dcc02f97b31
Instruction ID: d7a05e154b4087436aa91da66bef91f8e08ff7923aacb440fbb23df3fd4d01ae
Opcode Fuzzy Hash: 0feb0811099df3945d27071898244650c3f4633db531f857b0110dcc02f97b31
Instruction Fuzzy Hash: 91715936B0AB81D6EA248B15F85036973A2FB49B84F444035DE8D63B59DF3EE474C718

Function 00007FFD93BE4804 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 93COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFD93BE4849
PyUnicode_Compare.PYTHON312 ref: 00007FFD93BE48AC
_Py_Dealloc.PYTHON312 ref: 00007FFD93BE48C2

Strings

NFKD, xrefs: 00007FFD93BE4904
invalid normalization form, xrefs: 00007FFD93BE4926
NFKC, xrefs: 00007FFD93BE48CC
NFC, xrefs: 00007FFD93BE4835
NFD, xrefs: 00007FFD93BE48EC

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: CompareUnicode_$DeallocStringWith
String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
API String ID: 1004266020-3528878251
Opcode ID: cf64f6b9ab75cd253386f0f7453e80a2405618faa649494653d4230b278f9e28
Instruction ID: abb69137ffc2b640c23714e21a0d7849e3b0b0bc8f08c29f36b494cd91cc1b3a
Opcode Fuzzy Hash: cf64f6b9ab75cd253386f0f7453e80a2405618faa649494653d4230b278f9e28
Instruction Fuzzy Hash: 12415039B0C64385EA348B99E87023A63A9AF85B89F540036C9CD67754DF2DE4449392

Function 00007FFD93BE11B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 152COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFD93BE11E2
PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFD93BE11FA
PyType_IsSubtype.PYTHON312 ref: 00007FFD93BE121D

Part of subcall function 00007FFD93BE12F0: PyMem_Malloc.PYTHON312 ref: 00007FFD93BE1377
Part of subcall function 00007FFD93BE12F0: PyMem_Free.PYTHON312 ref: 00007FFD93BE1487

PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFD93BE369B

Strings

NFKD, xrefs: 00007FFD93BE36D7
invalid normalization form, xrefs: 00007FFD93BE3733
NFKC, xrefs: 00007FFD93BE11F0
NFC, xrefs: 00007FFD93BE11D8
NFD, xrefs: 00007FFD93BE3691

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: CompareStringUnicode_With$Mem_$FreeMallocSubtypeType_
String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
API String ID: 1723213316-3528878251
Opcode ID: 7d9693cf2d06923f90061d591c3b8a3e1c636af1e984342259c0b7d751c99e14
Instruction ID: 09014b6125d8d7a6e1979ba7db6a27968748a59a67c5db4df22968d7a1a5da1d
Opcode Fuzzy Hash: 7d9693cf2d06923f90061d591c3b8a3e1c636af1e984342259c0b7d751c99e14
Instruction Fuzzy Hash: 1951B465F0C24382FB708BADD83067D6399AF51BC8F645131DACDABB85DE1CE4419782

Function 00007FFD93BE43F0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 109COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FFD93BE4420
PyType_IsSubtype.PYTHON312 ref: 00007FFD93BE4483
PyUnicode_FromString.PYTHON312 ref: 00007FFD93BE449F

Strings

, xrefs: 00007FFD93BE4533
%04X, xrefs: 00007FFD93BE4548
argument, xrefs: 00007FFD93BE4412
a unicode character, xrefs: 00007FFD93BE440B
decomposition, xrefs: 00007FFD93BE4419

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: $%04X$a unicode character$argument$decomposition
API String ID: 1318908108-4056541097
Opcode ID: a3cef0d0996400cfa83e251a2d781e139d471a14dd81ecf0aeeb3af5fef58597
Instruction ID: b1976c8faab39890873ab38fef192c10a864918a02828d3a5f309d41da760b22
Opcode Fuzzy Hash: a3cef0d0996400cfa83e251a2d781e139d471a14dd81ecf0aeeb3af5fef58597
Instruction Fuzzy Hash: F441C872B08A8281EB358B59D8303B923A9FF85B98F444235D9AE276C4DF3CE545C341

Function 00007FF7868880B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7868880EF
GetWindowLongPtrW.USER32 ref: 00007FF78688816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF786888182
GetLastError.KERNEL32 ref: 00007FF78688818C
SetWindowLongPtrW.USER32 ref: 00007FF7868881A3

Strings

Needs to remove its temporary files., xrefs: 00007FF786888175

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: dbecf21c6b57b83a82042a90f62d88acd9b0bd1f3a952b3370318b3d4cdbe5f8
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: 6021D365B09A4292E751AB7AAD4417BE251FF88F91FA84130DE2D473D4DE2CDDA0C321

Function 00007FFD93AEA080 Relevance: 16.9, APIs: 2, Strings: 9, Instructions: 384COMMON

Download Yara Rule

Strings

%s.%s, xrefs: 00007FFD93AEA13C
_init, xrefs: 00007FFD93AEA36E
sqlite3_extension_init, xrefs: 00007FFD93AEA0FF
not authorized, xrefs: 00007FFD93AEA0E8
lib, xrefs: 00007FFD93AEA2C1
unable to open shared library [%.*s], xrefs: 00007FFD93AEA67F
sqlite3_, xrefs: 00007FFD93AEA273
error during initialization: %s, xrefs: 00007FFD93AEA436
no entry point [%s] in shared library [%s], xrefs: 00007FFD93AEA50C

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID:
String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%.*s]
API String ID: 0-3733955532
Opcode ID: e6e244be7666b45d99bae25022c0e031ba85be269f228b47f038ce02bb037d34
Instruction ID: 57d8dcc8fb170de21df646dd444289f718593b644d07b38115f9ae4d3793b780
Opcode Fuzzy Hash: e6e244be7666b45d99bae25022c0e031ba85be269f228b47f038ce02bb037d34
Instruction Fuzzy Hash: 6702B125B09A8281EA35DBA9E4742B977ACFF45B89F484135CE9F663A0DF3CE444C341

Function 00007FFD9E851030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFD9E851058
__scrt_initialize_crt.LIBCMT ref: 00007FFD9E85109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFD9E8510AA
_RTC_Initialize.LIBCMT ref: 00007FFD9E8510D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFD9E8510FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFD9E851129

Memory Dump Source

Source File: 00000002.00000002.3398881311.00007FFD9E851000.00000020.00000001.01000000.00000028.sdmp, Offset: 00007FFD9E850000, based on PE: true

Associated: 00000002.00000002.3398785576.00007FFD9E850000.00000002.00000001.01000000.00000028.sdmpDownload File
Associated: 00000002.00000002.3398898607.00007FFD9E854000.00000002.00000001.01000000.00000028.sdmpDownload File
Associated: 00000002.00000002.3398913456.00007FFD9E855000.00000004.00000001.01000000.00000028.sdmpDownload File
Associated: 00000002.00000002.3398946159.00007FFD9E856000.00000002.00000001.01000000.00000028.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9e850000_shost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: d8b20e02c901b865873e7091ce4e44ae4228cf79fcdaf74b4f9438ea969cd35b
Instruction ID: fff26e05a2b80b3da8de39fe7a6d183dcc667b71224645fc9b15a37d97ce4d38
Opcode Fuzzy Hash: d8b20e02c901b865873e7091ce4e44ae4228cf79fcdaf74b4f9438ea969cd35b
Instruction Fuzzy Hash: 7B819F21F0CA4386FB70ABE694F12B926D0AFD5B80F8445B5D90D87796DF3CE80587A0

Function 00007FFD9E841030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFD9E841058
__scrt_initialize_crt.LIBCMT ref: 00007FFD9E84109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFD9E8410AA
_RTC_Initialize.LIBCMT ref: 00007FFD9E8410D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFD9E8410FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFD9E841129

Memory Dump Source

Source File: 00000002.00000002.3398726014.00007FFD9E841000.00000020.00000001.01000000.00000029.sdmp, Offset: 00007FFD9E840000, based on PE: true

Associated: 00000002.00000002.3398673718.00007FFD9E840000.00000002.00000001.01000000.00000029.sdmpDownload File
Associated: 00000002.00000002.3398743429.00007FFD9E846000.00000002.00000001.01000000.00000029.sdmpDownload File
Associated: 00000002.00000002.3398761417.00007FFD9E84B000.00000002.00000001.01000000.00000029.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9e840000_shost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 3667c9311effcda5bebfcd6f0c463b07b4ccdab133b9d1969c09bf43b1d98b8c
Instruction ID: 8fd7f84bed4fd0a40707217a58bcf700a07841b28899b5ca356dc1c53f95303c
Opcode Fuzzy Hash: 3667c9311effcda5bebfcd6f0c463b07b4ccdab133b9d1969c09bf43b1d98b8c
Instruction Fuzzy Hash: 51816AA1F1C24786FA70ABE694E12B96690EFDDB80F444335D90D87796FE3CE8458720

Function 00007FFDA32F1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDA32F1058
__scrt_initialize_crt.LIBCMT ref: 00007FFDA32F109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDA32F10AA
_RTC_Initialize.LIBCMT ref: 00007FFDA32F10D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDA32F10FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFDA32F1129

Memory Dump Source

Source File: 00000002.00000002.3399773954.00007FFDA32F1000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00007FFDA32F0000, based on PE: true

Associated: 00000002.00000002.3399757109.00007FFDA32F0000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000002.00000002.3399790328.00007FFDA32F3000.00000002.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000002.00000002.3399805937.00007FFDA32F4000.00000004.00000001.01000000.0000001E.sdmpDownload File
Associated: 00000002.00000002.3399820426.00007FFDA32F5000.00000002.00000001.01000000.0000001E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda32f0000_shost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: a8949dbd94157f52c715e3a2c1859cda40e32930befb75e85101528a9057b2a9
Instruction ID: 19634f518242dbc2109400f52929cd8fc2eaeca21bbe27ee103b3444049fae12
Opcode Fuzzy Hash: a8949dbd94157f52c715e3a2c1859cda40e32930befb75e85101528a9057b2a9
Instruction Fuzzy Hash: AA819E20F0F247C6FA54AB66947127A2292AF85B80F844135DA0D6779FDF3FF4258B08

Function 00007FFDA3531030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFDA3531058
__scrt_initialize_crt.LIBCMT ref: 00007FFDA353109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFDA35310AA
_RTC_Initialize.LIBCMT ref: 00007FFDA35310D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFDA35310FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFDA3531129

Memory Dump Source

Source File: 00000002.00000002.3399927928.00007FFDA3531000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FFDA3530000, based on PE: true

Associated: 00000002.00000002.3399906871.00007FFDA3530000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399946107.00007FFDA3533000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399964219.00007FFDA3534000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399983040.00007FFDA3535000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3530000_shost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 632739f6e53f99d3db5e33da1e5c0ad35d4cb4c9218bf9d76c45be126c9d3af3
Instruction ID: 8417b7a916414039eda7ea204f04b799eb50fc546a64740c67e8f01a52e9a87c
Opcode Fuzzy Hash: 632739f6e53f99d3db5e33da1e5c0ad35d4cb4c9218bf9d76c45be126c9d3af3
Instruction Fuzzy Hash: E481B221F0E68346F65ABB7E94712B912A3AF45780F044C35E90DA7797DF3EE6418708

Function 00007FFD93BE2740 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFD93BE2768
__scrt_initialize_crt.LIBCMT ref: 00007FFD93BE27AD
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFD93BE27BA
_RTC_Initialize.LIBCMT ref: 00007FFD93BE27E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFD93BE280E
__scrt_release_startup_lock.LIBCMT ref: 00007FFD93BE2839

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: ba629577db6599826cb9fb44cf19b8c727e776d8ab71a1e0ce86f35fe3adb7c8
Instruction ID: 0af43ab89aaedb57407559e23c355404633559058762ff74112432f63f8f8be7
Opcode Fuzzy Hash: ba629577db6599826cb9fb44cf19b8c727e776d8ab71a1e0ce86f35fe3adb7c8
Instruction Fuzzy Hash: 3981B021F0C64746FA74BBEDD4712BD22A8AF85788F448035D9CD6B396DE3CE8458782

Function 00007FFDA3532170 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA35321E3
_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA353220B
memcpy.VCRUNTIME140 ref: 00007FFDA353225D
memcpy.VCRUNTIME140 ref: 00007FFDA35322A5
memcpy.VCRUNTIME140 ref: 00007FFDA3532389

Strings

src/raw_cfb.c, xrefs: 00007FFDA35321FD
(direction == DirEncrypt) || (direction == DirDecrypt), xrefs: 00007FFDA3532204
src/raw_cfb.c, xrefs: 00007FFDA35321D5
cfbState->usedKeyStream <= segment_len, xrefs: 00007FFDA35321DC

Memory Dump Source

Source File: 00000002.00000002.3399927928.00007FFDA3531000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FFDA3530000, based on PE: true

Associated: 00000002.00000002.3399906871.00007FFDA3530000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399946107.00007FFDA3533000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399964219.00007FFDA3534000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399983040.00007FFDA3535000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3530000_shost.jbxd

Similarity

API ID: memcpy$_wassert
String ID: (direction == DirEncrypt) || (direction == DirDecrypt)$cfbState->usedKeyStream <= segment_len$src/raw_cfb.c$src/raw_cfb.c
API String ID: 4178124637-3209691050
Opcode ID: b649bd0a1d546711c851ea8078f7825d9fd1ee49c3c19a2c630744d5683e58bf
Instruction ID: ffcc1e8c9a8b420cee1007e89083716fc8dbc9e365c1a8a798a666782ed8c001
Opcode Fuzzy Hash: b649bd0a1d546711c851ea8078f7825d9fd1ee49c3c19a2c630744d5683e58bf
Instruction Fuzzy Hash: 6A610472B1ABC582E7168B29F4206696B62FB95BC4F008A31DF9C63B46DF3DE551C304

Function 00007FFD93BE45B4 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFD93BE45E7
_PyArg_BadArgument.PYTHON312 ref: 00007FFD93BE461C
_PyUnicode_ToDigit.PYTHON312 ref: 00007FFD93BE463E
PyErr_SetString.PYTHON312 ref: 00007FFD93BE465E
PyLong_FromLong.PYTHON312 ref: 00007FFD93BE4678

Strings

not a digit, xrefs: 00007FFD93BE4654
digit, xrefs: 00007FFD93BE45E0, 00007FFD93BE460E
argument 1, xrefs: 00007FFD93BE4615
a unicode character, xrefs: 00007FFD93BE4607

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Arg_$ArgumentCheckDigitErr_FromLongLong_PositionalStringUnicode_
String ID: a unicode character$argument 1$digit$not a digit
API String ID: 4245020737-4278345224
Opcode ID: 63a51ef3fb3b37699c37d838a5587871e01ab33192532b5daca7f17e7c8dcafb
Instruction ID: 42f94b0b146b46fe4f364f97c8875e12e5943285a1d6cfd7095e3b55e2c3c027
Opcode Fuzzy Hash: 63a51ef3fb3b37699c37d838a5587871e01ab33192532b5daca7f17e7c8dcafb
Instruction Fuzzy Hash: B0213331F08A4396EB308F99E86417A2368FF54B8CF454172D98D67668DF2DE445C742

Function 00007FFD93AB0670 Relevance: 15.5, APIs: 1, Strings: 9, Instructions: 487COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93AB073C

Strings

out of memory, xrefs: 00007FFD93AB07A8
indexed, xrefs: 00007FFD93AB0960
foreign key, xrefs: 00007FFD93AB0913
cannot open table without rowid: %s, xrefs: 00007FFD93AB0CD6
no such column: "%s", xrefs: 00007FFD93AB0CB9
3|r<, xrefs: 00007FFD93AB068C
cannot open %s column for writing, xrefs: 00007FFD93AB0C9B
cannot open view: %s, xrefs: 00007FFD93AB0CCD
cannot open virtual table: %s, xrefs: 00007FFD93AB0CDF

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memset
String ID: 3|r<$cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"$out of memory
API String ID: 2221118986-3955620218
Opcode ID: 03897e441df2d862a11abd7c571b6c08745252c109b0439b73eca122056b4575
Instruction ID: 122db2fd7c05d0a36f3864c91b9be59f3be2fb0bcb983710d6aa89a2b8a6c83a
Opcode Fuzzy Hash: 03897e441df2d862a11abd7c571b6c08745252c109b0439b73eca122056b4575
Instruction Fuzzy Hash: AE328C72B08B818AEB64CFA6D4A06BD37B8FB45B88F504235DA8D67795DF38E550C700

Function 00007FFD93AA8CC0 Relevance: 15.3, APIs: 2, Strings: 8, Instructions: 333COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFD93AA8DC4
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFD93AA8EA4

Strings

'%.*q', xrefs: 00007FFD93AA9015
%lld, xrefs: 00007FFD93AA8F61
-- , xrefs: 00007FFD93AA8D53
zeroblob(%d), xrefs: 00007FFD93AA9060
NULL, xrefs: 00007FFD93AA8F2D
%!.15g, xrefs: 00007FFD93AA8F7E
%02x, xrefs: 00007FFD93AA90C4
?, xrefs: 00007FFD93AA8EB8

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: %!.15g$%02x$%lld$'%.*q'$-- $?$NULL$zeroblob(%d)
API String ID: 3510742995-875588658
Opcode ID: 16d008353a86a17181fc82ee59aa0570df11fdf5eee4c13a673956b181233919
Instruction ID: cf1c891473dac5b300e239fecf3154f71bba9c1c605f0a8233f790499a1f1a2e
Opcode Fuzzy Hash: 16d008353a86a17181fc82ee59aa0570df11fdf5eee4c13a673956b181233919
Instruction Fuzzy Hash: C6E18123F0868699FB70CBA5D4643BC27AAAB04798F40413ADE4EB7695DF3CE845C341

Function 00007FFD93AC4AB0 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 325COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93AC4E18

Strings

Cannot add a UNIQUE column, xrefs: 00007FFD93AC4BE3
SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*', xrefs: 00007FFD93AC4F91
cannot add a STORED column, xrefs: 00007FFD93AC4DB4
Cannot add a NOT NULL column with default value NULL, xrefs: 00007FFD93AC4C55
Cannot add a column with non-constant default, xrefs: 00007FFD93AC4CAF
Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FFD93AC4C33
UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FFD93AC4E5C
Cannot add a PRIMARY KEY column, xrefs: 00007FFD93AC4BC8
SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FFD93AC4C3D, 00007FFD93AC4CB9, 00007FFD93AC4DC3

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*'$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
API String ID: 3510742995-3865411212
Opcode ID: 6145248e7b04b0619e5a8fcb440d0d42fd806850070c73835079349b62662a14
Instruction ID: 8a172baeb63db0eee25b688047cea030fc6ce2a8ba2ffc2c49f071ca768f2654
Opcode Fuzzy Hash: 6145248e7b04b0619e5a8fcb440d0d42fd806850070c73835079349b62662a14
Instruction Fuzzy Hash: 62E1AC22B09B8281EB76EB99D5647BA27A9FB44BC8F054131CE8D677A5DF3CE411C304

Function 00007FF786896300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF786896343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF786896730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868969CC

Strings

f, xrefs: 00007FF786896465
-, xrefs: 00007FF7868963D9
:, xrefs: 00007FF7868964FC
p, xrefs: 00007FF7868963F5
p, xrefs: 00007FF78689646D

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 11f983cfab09e40dcd94958a0f2ec509d6fccee5f44fc3d70b49902cb7dfe7ed
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: B1127061A0C153A6FB247B149954A7BF6A1FB40750FE84135E68E46AC4EB3CFDE0DB20

Function 00007FF786891038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF786891078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF786891440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868916DF

Strings

p, xrefs: 00007FF78689111D
f, xrefs: 00007FF7868912C5
p, xrefs: 00007FF786891182
f, xrefs: 00007FF786891110
f, xrefs: 00007FF78689117A

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: b2e8acd4dbe8837da0b47fc2a0965fbe87dee985d8d36ab0021dc6111c1598ed
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: A4125E32E0C143A5FB24BA55E85467BA262FB41754FE84035E6DD46BC4EB7CF8A0DB20

Function 00007FFD93A7F9D0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON

Download Yara Rule

APIs

new[].MSPDB140-MSVCRT ref: 00007FFD93A7FAE7

Strings

:, xrefs: 00007FFD93A7FA3C
%s%c%s, xrefs: 00007FFD93A7FA46
winFullPathname2, xrefs: 00007FFD93A7FB55
winFullPathname1, xrefs: 00007FFD93A7FACC
?, xrefs: 00007FFD93A7FA11
:, xrefs: 00007FFD93A7FA01
\, xrefs: 00007FFD93A7FA58

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: new[]
String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
API String ID: 4059295235-3840279414
Opcode ID: 407565720c01e4f4dae024f18073d7389dd2ad845b77d27617bea5722536b943
Instruction ID: 87484a8bbf4226a1919a508af888b738ee6b95087fbc3500f3e53a7872ba4d78
Opcode Fuzzy Hash: 407565720c01e4f4dae024f18073d7389dd2ad845b77d27617bea5722536b943
Instruction Fuzzy Hash: 08510321F0C68645FB359BE5A4B16BA6799EF84F8CF484035DE4F23686DE3CE5458300

Function 00007FF786881050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF786881108
malloc, xrefs: 00007FF78688110F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF786881098
fread, xrefs: 00007FF7868811FD
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7868810CC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7868811F6
fseek, xrefs: 00007FF7868810D3

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: e30da66bd449e278f4e1a8a1da43a6fc232ee02027dbecaf9a0becaf305aee32
Instruction ID: 5856060444445bedea1e9987b49ab4bc4e4e4ed5f2f7d2cff03340908795a096
Opcode Fuzzy Hash: e30da66bd449e278f4e1a8a1da43a6fc232ee02027dbecaf9a0becaf305aee32
Instruction Fuzzy Hash: 9D416D25A18653A6EA10FB12AC006BBE391BF54FC4FE44432ED4D47796EE3CE925C760

Function 00007FF786888850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF786883CBB), ref: 00007FF7868888F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF786883CBB), ref: 00007FF7868888FA
CreateDirectoryW.KERNEL32(?,00000000,00007FF786883CBB), ref: 00007FF78688893C

Part of subcall function 00007FF786888A20: GetEnvironmentVariableW.KERNEL32(00007FF78688388E), ref: 00007FF786888A57
Part of subcall function 00007FF786888A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF786888A79

Part of subcall function 00007FF7868982A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868982C1

Part of subcall function 00007FF786882810: MessageBoxW.USER32 ref: 00007FF7868828EA

Strings

LOADER: failed to set the TMP environment variable., xrefs: 00007FF7868888CC
TMP, xrefs: 00007FF78688888C, 00007FF786888993
TMP, xrefs: 00007FF7868888B2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF78688896E
_MEI%d, xrefs: 00007FF786888902

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 6ea14b1c2d16789ddeaa0d8cc05df9935aa6d91fa7ad17376743f3d33dced37a
Instruction ID: e80f85e9115bd43bfd1e125a96ca807e243bdb7f044dfdcdd7aec694fa0634d8
Opcode Fuzzy Hash: 6ea14b1c2d16789ddeaa0d8cc05df9935aa6d91fa7ad17376743f3d33dced37a
Instruction Fuzzy Hash: 0241A351A1864365FA20FB66AC552BB9291BF88B84FE00031DD0D4B7D6EE3CED21C721

Function 00007FF78688EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF78688EAD5

Part of subcall function 00007FF78688FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF78688FA6F
Part of subcall function 00007FF78688FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF78688FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF78688EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF78688EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF78688EF08

Strings

csm, xrefs: 00007FF78688EAEF
csm, xrefs: 00007FF78688EBD0
csm, xrefs: 00007FF78688EB56

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: 0175cd00535e90fe6745a9ce39f04f2b9fc869f4c5c34bff979055195bc0ce8e
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: BBD19232A0874197EB20EF65E8443AEB7A0FB55B98F600135EE4D57B96DF38E860C710

Function 00007FFD93ACF030 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 405COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93ACF0CA

Strings

view, xrefs: 00007FFD93ACF15E, 00007FFD93ACF273
table, xrefs: 00007FFD93ACF165
%s %T already exists, xrefs: 00007FFD93ACF26C
sqlite_master, xrefs: 00007FFD93ACF05F, 00007FFD93ACF1B2, 00007FFD93ACF4FF
temporary table name must be unqualified, xrefs: 00007FFD93ACF0FE
sqlite_temp_master, xrefs: 00007FFD93ACF087, 00007FFD93ACF18D
there is already an index named %s, xrefs: 00007FFD93ACF2D7

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: %s %T already exists$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3510742995-2846519077
Opcode ID: 2d6028fd504a58bcbeaa15aec6dd8e75ddf9d79cbd95442505d2afc3243fe5d6
Instruction ID: c55b28f23c3ad8a40620142addf559943e1a2502dce489655323334c6168cf56
Opcode Fuzzy Hash: 2d6028fd504a58bcbeaa15aec6dd8e75ddf9d79cbd95442505d2afc3243fe5d6
Instruction Fuzzy Hash: E102CC62B0878286EB64EF69D4207A937A9FB85F88F408235CE8D67795DF3CE545C700

Function 00007FF78689ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF78689F11A,?,?,00000271C24B6668,00007FF78689ADC3,?,?,?,00007FF78689ACBA,?,?,?,00007FF786895FAE), ref: 00007FF78689EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF78689F11A,?,?,00000271C24B6668,00007FF78689ADC3,?,?,?,00007FF78689ACBA,?,?,?,00007FF786895FAE), ref: 00007FF78689EF08

Strings

ext-ms-, xrefs: 00007FF78689EE59
api-ms-, xrefs: 00007FF78689EE46

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: 09e59fd32b45a94c5035fa03d43adf9da5d58995c333a2338ba9b2e39a59e429
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: CB41B321B19A1266EA15EB16AC0857BA791BF48B90FE84539DD1D47784EE3CFC25C320

Function 00007FF786882C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF786883706,?,00007FF786883804), ref: 00007FF786882C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF786883706,?,00007FF786883804), ref: 00007FF786882D63
MessageBoxW.USER32 ref: 00007FF786882D99

Strings

[PYI-%d:ERROR] , xrefs: 00007FF786882CA6
%ls: , xrefs: 00007FF786882D22
Error, xrefs: 00007FF786882D8C
<FormatMessageW failed.>, xrefs: 00007FF786882D70

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: 354b0d2f2e59e7d0e6090f44bfe78338ae979c7e36ff76cea8f0748642dfb16d
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: CE310822708B4166E720BB21BC106ABA692BF88BC9F900135EF4D93759EF3CD916C310

Function 00007FFD93AF0FB0 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 331COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93AF1129

Strings

CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text), xrefs: 00007FFD93AF1054
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 00007FFD93AF132A
table, xrefs: 00007FFD93AF0FDA
ase, xrefs: 00007FFD93AF1238
sqlite_master, xrefs: 00007FFD93AF0FFC
3|r<, xrefs: 00007FFD93AF0FC9
sqlite_temp_master, xrefs: 00007FFD93AF0FF5

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: 3|r<$CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)$SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master$table
API String ID: 3510742995-28684124
Opcode ID: fa8406efdf9b218808a62f6da871acfc486fbd5f740cb311a2b2572159213d61
Instruction ID: 785e14b091bb5c6dbeafc0cb51cf8a8177cfeb3d018a7fad6728e2d2c2b48ed7
Opcode Fuzzy Hash: fa8406efdf9b218808a62f6da871acfc486fbd5f740cb311a2b2572159213d61
Instruction Fuzzy Hash: 0CE1BC22F08B928AEB24DBA5C4606BD37E9FB65B98F054235CE4D67B91DF38E451C340

Function 00007FFD93AC5F30 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 302COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93AC605F
memset.VCRUNTIME140 ref: 00007FFD93AC6112
memcpy.VCRUNTIME140 ref: 00007FFD93AC613B
memcpy.VCRUNTIME140 ref: 00007FFD93AC621B
memcpy.VCRUNTIME140 ref: 00007FFD93AC62FD
memcpy.VCRUNTIME140 ref: 00007FFD93AC6325

Strings

%Q%s, xrefs: 00007FFD93AC6284
"%w" , xrefs: 00007FFD93AC5FE0

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy$memset
String ID: "%w" $%Q%s
API String ID: 438689982-1987291987
Opcode ID: 4a1c78b13e2f01aff48856fdd1c00aa2aae5a18c99be8c7287e641d0a8497d49
Instruction ID: 9e8e0e8bf5b0611b0ab91bbb3caadee53504361ceec4b0e6de4fa095995a3c2d
Opcode Fuzzy Hash: 4a1c78b13e2f01aff48856fdd1c00aa2aae5a18c99be8c7287e641d0a8497d49
Instruction Fuzzy Hash: 51C1B562B08B8189EA34DF9AE46027977A4FB55BA4F484235DE9E277E5DF3CE440C700

Function 00007FFD93A8F7C0 Relevance: 12.3, APIs: 5, Strings: 3, Instructions: 255COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93A8FA7D
memcpy.VCRUNTIME140 ref: 00007FFD93A8FAE5

Strings

database corruption, xrefs: 00007FFD93A8F84A
%s at line %d of [%.10s], xrefs: 00007FFD93A8F856
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A8F83E

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 3510742995-3764764234
Opcode ID: 773eb238a883d3300a3173700000ad65d033ffa64abbeb7688677eda9b870ccb
Instruction ID: 603ff7ce2a2c1e5a846767007cd9a5bb27a6c35908b45e10428ab52bd176612e
Opcode Fuzzy Hash: 773eb238a883d3300a3173700000ad65d033ffa64abbeb7688677eda9b870ccb
Instruction Fuzzy Hash: 7AA12432B0C2D24BD7748BA9E4646BE7B99FB81784F444139DBCA93681DE3CE546C710

Function 00007FFD93A81A30 Relevance: 11.0, APIs: 1, Strings: 6, Instructions: 471COMMON

Download Yara Rule

Strings

misuse, xrefs: 00007FFD93A81BDA, 00007FFD93A81C40
ATTACH x AS %Q, xrefs: 00007FFD93A81AC5
API called with NULL prepared statement, xrefs: 00007FFD93A81B97
%s at line %d of [%.10s], xrefs: 00007FFD93A81BE6, 00007FFD93A81C4C
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A81AA8, 00007FFD93A81C33
API called with finalized prepared statement, xrefs: 00007FFD93A81BAD, 00007FFD93A81C24

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$misuse
API String ID: 0-3554312789
Opcode ID: 803b00a4a517a302cef388af85fc7d9d96348ec889fbd731ba916e00af1c20e0
Instruction ID: 48be616e8bd602a516bced8c43406cf6ba6ed1f9ff835894654b16e47ac6731f
Opcode Fuzzy Hash: 803b00a4a517a302cef388af85fc7d9d96348ec889fbd731ba916e00af1c20e0
Instruction Fuzzy Hash: 5E327132F09B8582EA24DF68D5642BD33A8FB94B88F149235CF8D67652DF38E595C340

Function 00007FFDA3531D80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3531DEF
memcpy.VCRUNTIME140 ref: 00007FFDA3531E33
memcpy.VCRUNTIME140 ref: 00007FFDA3531E67

Strings

@, xrefs: 00007FFDA3531E6E
src/raw_cfb.c, xrefs: 00007FFDA3531DE1
cfbState->usedKeyStream <= segment_len, xrefs: 00007FFDA3531DE8

Memory Dump Source

Source File: 00000002.00000002.3399927928.00007FFDA3531000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FFDA3530000, based on PE: true

Associated: 00000002.00000002.3399906871.00007FFDA3530000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399946107.00007FFDA3533000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399964219.00007FFDA3534000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399983040.00007FFDA3535000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3530000_shost.jbxd

Similarity

API ID: memcpy$_wassert
String ID: @$cfbState->usedKeyStream <= segment_len$src/raw_cfb.c
API String ID: 4178124637-1361193148
Opcode ID: 291840892e0951460bb4d7aa888ad5ee9f86b5d89407f6ece59ae0693007ec5f
Instruction ID: 4fe2ad64f13389f836421695f41382c28c2bca4835c2fba818990fc9cc42247e
Opcode Fuzzy Hash: 291840892e0951460bb4d7aa888ad5ee9f86b5d89407f6ece59ae0693007ec5f
Instruction Fuzzy Hash: 4E5103A2F16B8182EB0A9B39E4205796762FB85BD4F044A31DF8D23746EF3DE251C304

Function 00007FFD93BE16F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFD93BE17C8
PyUnicode_FromString.PYTHON312 ref: 00007FFD93BE182C
_PyArg_BadArgument.PYTHON312 ref: 00007FFD93BE38EA

Strings

category, xrefs: 00007FFD93BE38E3
argument, xrefs: 00007FFD93BE38DC
a unicode character, xrefs: 00007FFD93BE38D5

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: a unicode character$argument$category
API String ID: 1318908108-2068800536
Opcode ID: 75ddb3696b46489ca6549d465876fca1f165cfd7b87c949410c65a543f1dc5fb
Instruction ID: 47f3a4045169fe32271ed39280d6da8c46efc506eff782fd1556ade7048351ed
Opcode Fuzzy Hash: 75ddb3696b46489ca6549d465876fca1f165cfd7b87c949410c65a543f1dc5fb
Instruction Fuzzy Hash: 5C51C666B18A5681EF788B4DD4702BC23A9FB84B88F541035DACF67790DF2CE891D391

Function 00007FFD93BE1000 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFD93BE10D3
PyUnicode_FromString.PYTHON312 ref: 00007FFD93BE10F8
_PyArg_BadArgument.PYTHON312 ref: 00007FFD93BE35B0

Strings

bidirectional, xrefs: 00007FFD93BE35A9
argument, xrefs: 00007FFD93BE35A2
a unicode character, xrefs: 00007FFD93BE359B

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Arg_ArgumentFromStringSubtypeType_Unicode_
String ID: a unicode character$argument$bidirectional
API String ID: 1318908108-2110215792
Opcode ID: 6f7a0223ee0090118d1ffdd6d95c782b73d4ddee4bbf01c7b704a6e76ba36895
Instruction ID: 3e0f33055c352f8d0bee0a8f9c1b6be49f95e8056b6ca64c0af3b51cf7ea4274
Opcode Fuzzy Hash: 6f7a0223ee0090118d1ffdd6d95c782b73d4ddee4bbf01c7b704a6e76ba36895
Instruction Fuzzy Hash: DE41E866B1868281EB788B4EC47137923A9FB44799F541135DADF63780CF2DE890C382

Function 00007FF78688DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF78688DFEA,?,?,?,00007FF78688DCDC,?,?,?,00007FF78688D8D9), ref: 00007FF78688DDBD
GetLastError.KERNEL32(?,?,?,00007FF78688DFEA,?,?,?,00007FF78688DCDC,?,?,?,00007FF78688D8D9), ref: 00007FF78688DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF78688DFEA,?,?,?,00007FF78688DCDC,?,?,?,00007FF78688D8D9), ref: 00007FF78688DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF78688DFEA,?,?,?,00007FF78688DCDC,?,?,?,00007FF78688D8D9), ref: 00007FF78688DE63
GetProcAddress.KERNEL32(?,?,?,00007FF78688DFEA,?,?,?,00007FF78688DCDC,?,?,?,00007FF78688D8D9), ref: 00007FF78688DE6F

Strings

api-ms-, xrefs: 00007FF78688DDDD

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: bd9e8b975e1c356c54e31faf7cc674de7d6d5d3142161216ff9d617bde7497ae
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: 8C316121B1AA42A5EE52AB12AC00576E394FF58FA0FB94535ED1D47784EF3CE864C720

Function 00007FF786882A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF78688351A,?,00000000,00007FF786883F23), ref: 00007FF786882AA0

Strings

Warning, xrefs: 00007FF786882B1E
Warning [ANSI Fallback], xrefs: 00007FF786882B0F
WARNING, xrefs: 00007FF786882AAF
[PYI-%d:%s] , xrefs: 00007FF786882AA8
0, xrefs: 00007FF786882B16

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 75da2a18e35ea2fbdc216ba120d0993621886b892c6cd49cdd0867d5e8c4c1ca
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: EE218132A18782A6E720EB51BC817E7A7A4FB887C4F900132EE8D53659DF3CDA55C750

Function 00007FF786888760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF786888780
OpenProcessToken.ADVAPI32 ref: 00007FF786888793
GetTokenInformation.ADVAPI32 ref: 00007FF7868887B8
GetLastError.KERNEL32 ref: 00007FF7868887C2
GetTokenInformation.ADVAPI32 ref: 00007FF786888802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF78688881E
CloseHandle.KERNEL32 ref: 00007FF786888836

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1e3bf3a8b1345e2c0c0bdd6ff4e06add0bb9355989cc78c5a669156b3459c754
Instruction ID: 737e1cc9e312d5382d2dd48a68685e994e9840502e45c352efb8c21d7b852d4f
Opcode Fuzzy Hash: 1e3bf3a8b1345e2c0c0bdd6ff4e06add0bb9355989cc78c5a669156b3459c754
Instruction Fuzzy Hash: B5219131A0C64352EB10AB55F85023BE7A1FF85BA1FA00235EAAD47AE4DF7CD864C710

Function 00007FF78689B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF78689B1CF
FlsGetValue.KERNEL32 ref: 00007FF78689B1E4
FlsSetValue.KERNEL32 ref: 00007FF78689B205
FlsSetValue.KERNEL32 ref: 00007FF78689B232
FlsSetValue.KERNEL32 ref: 00007FF78689B243
FlsSetValue.KERNEL32 ref: 00007FF78689B254
SetLastError.KERNEL32 ref: 00007FF78689B26F

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7a7efe5704aebd884d83a549bac9021180a30b6e3a5084d39c82c78793c2ea5e
Instruction ID: e68434411429e203eee3280b112217bf10f4a093fff05d38d5bed55016097dac
Opcode Fuzzy Hash: 7a7efe5704aebd884d83a549bac9021180a30b6e3a5084d39c82c78793c2ea5e
Instruction Fuzzy Hash: 28216020E0C2466AF66877A15E5513FE142BF487A0FB44634E83E06AD6EE3CBC20C320

Function 00007FF7868A7DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7868A7E0D
GetLastError.KERNEL32 ref: 00007FF7868A7E19
CloseHandle.KERNEL32 ref: 00007FF7868A7E31
CreateFileW.KERNEL32 ref: 00007FF7868A7E5C
WriteConsoleW.KERNEL32 ref: 00007FF7868A7E7B

Strings

CONOUT$, xrefs: 00007FF7868A7E3D

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: fba6de0e6791b03a0d2e21769cdaaa59ae50f350ebfe17d143e8542a6c8ca807
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: 08118121B18A419AE350AB52FC5432AA7A5FB88FE5FA00234EE5D87794DF3CDC24C751

Function 00007FFD93BE1150 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFD93BE3607
_PyArg_BadArgument.PYTHON312 ref: 00007FFD93BE363A

Part of subcall function 00007FFD93BE11B0: PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFD93BE11E2
Part of subcall function 00007FFD93BE11B0: PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FFD93BE11FA
Part of subcall function 00007FFD93BE11B0: PyType_IsSubtype.PYTHON312 ref: 00007FFD93BE121D

Strings

normalize, xrefs: 00007FFD93BE35FA, 00007FFD93BE3633
argument 2, xrefs: 00007FFD93BE3625
argument 1, xrefs: 00007FFD93BE3619
str, xrefs: 00007FFD93BE362C

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Arg_CompareStringUnicode_With$ArgumentCheckPositionalSubtypeType_
String ID: argument 1$argument 2$normalize$str
API String ID: 4101545800-1320425463
Opcode ID: 2dbf24b9019d36270aeee854f5eb720b9aec5d3fd397e623ab08701816bde558
Instruction ID: 2fa834e36b09aee44250c05d07724a3d235f2d9f33d64110fc85dc1b743de89d
Opcode Fuzzy Hash: 2dbf24b9019d36270aeee854f5eb720b9aec5d3fd397e623ab08701816bde558
Instruction Fuzzy Hash: 48118861F0CA8294EB708B99E5A16B92364EF44FC8F558032D94D2B754DF2CD584D782

Function 00007FFD93AABBA4 Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 354COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93AABC24

Strings

no such savepoint: %s, xrefs: 00007FFD93AABCA4
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93AAFA92, 00007FFD93AAFDF0
cannot open savepoint - SQL statements in progress, xrefs: 00007FFD93AAFABE
cannot release savepoint - SQL statements in progress, xrefs: 00007FFD93AAFADF
statement aborts at %d: [%s] %s, xrefs: 00007FFD93AB005F

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: 831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$cannot open savepoint - SQL statements in progress$cannot release savepoint - SQL statements in progress$no such savepoint: %s$statement aborts at %d: [%s] %s
API String ID: 3510742995-2526444651
Opcode ID: c9d744cff9dc738ede1e2a386e920d6a7cb1c7740c9bf092cb904dc52b4c502a
Instruction ID: ac02f181069b65cdb2590b1e2136509ff956dbdf146634ee03272607cc9c6a37
Opcode Fuzzy Hash: c9d744cff9dc738ede1e2a386e920d6a7cb1c7740c9bf092cb904dc52b4c502a
Instruction Fuzzy Hash: 55F1DD32B0869686EB74CB96D46467E6BE9FB45B88F010035DA4DA7B95CF3DE841CB00

Function 00007FFD93AD3430 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 330COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93AD357B
memcpy.VCRUNTIME140 ref: 00007FFD93AD35C7
memcpy.VCRUNTIME140 ref: 00007FFD93AD383C

Strings

foreign key on %s should reference only one column of table %T, xrefs: 00007FFD93AD34B5
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FFD93AD34DE
unknown column "%s" in foreign key definition, xrefs: 00007FFD93AD37CC

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 438689982-272990098
Opcode ID: d33b407a10e7d0ad13c26d0ca43705fecfafde5626fadbf1de958564b7d48643
Instruction ID: a136766f634a0f748bbe00c280f88d00d9ccd3d0371f659c87c120eb717fcc63
Opcode Fuzzy Hash: d33b407a10e7d0ad13c26d0ca43705fecfafde5626fadbf1de958564b7d48643
Instruction Fuzzy Hash: DBD1EF62F09B8282EB71CB9694646BE6BA9FB45B84F444235DE6E237C5DF3CE441C300

Function 00007FFD93ABDF70 Relevance: 9.3, APIs: 2, Strings: 4, Instructions: 309COMMON

Download Yara Rule

Strings

REUSE SUBQUERY %d, xrefs: 00007FFD93ABDFC2
CORRELATED , xrefs: 00007FFD93ABE049
Expression tree is too large (maximum depth %d), xrefs: 00007FFD93ABE352
%sSCALAR SUBQUERY %d, xrefs: 00007FFD93ABE052

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID:
String ID: %sSCALAR SUBQUERY %d$CORRELATED $Expression tree is too large (maximum depth %d)$REUSE SUBQUERY %d
API String ID: 0-875495356
Opcode ID: 10ff3258e64045ebdc24c4453d9eddf26351157b953658b18b77b9d73fe27bc8
Instruction ID: 93fd64a979abedd9c640aa5156e7c5199086b62efb093e7d57c904375cf60b0d
Opcode Fuzzy Hash: 10ff3258e64045ebdc24c4453d9eddf26351157b953658b18b77b9d73fe27bc8
Instruction Fuzzy Hash: 01D11072B087818BE764CF65E5606AA77A9FB85788F008235DB8D53B85DF3CE4A0C700

Function 00007FFD93AA6B10 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 278COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93AA6F2D

Strings

misuse, xrefs: 00007FFD93AA6B6D
API called with NULL prepared statement, xrefs: 00007FFD93AA6B2B
%s at line %d of [%.10s], xrefs: 00007FFD93AA6B79
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93AA6B60
API called with finalized prepared statement, xrefs: 00007FFD93AA6B41

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$API called with NULL prepared statement$API called with finalized prepared statement$misuse
API String ID: 3510742995-774319783
Opcode ID: c1f2e72d02041f634680d4dfe94196d23bd266405e708ce222b3484ffe9b10a2
Instruction ID: e04bd94296e6e705e856724fe21aaec4ceecd235fa0718f48aed0a6390395658
Opcode Fuzzy Hash: c1f2e72d02041f634680d4dfe94196d23bd266405e708ce222b3484ffe9b10a2
Instruction Fuzzy Hash: 2AE18027F09BC585E6258B68C6143FC6365FBA9B48F14A235DF9C63262EF38E1D58300

Function 00007FFD93A93D20 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 260COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93A93ECE
memcpy.VCRUNTIME140 ref: 00007FFD93A94006
memcpy.VCRUNTIME140 ref: 00007FFD93A94020

Strings

database corruption, xrefs: 00007FFD93A93D71
%s at line %d of [%.10s], xrefs: 00007FFD93A93D7D
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A93D65

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy$memset
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 438689982-3764764234
Opcode ID: 5ead039ea019e468920b661798225550cc5a4065f9c0ad80161278c7ae253c2a
Instruction ID: 8d5a1924a2c20480a759547c1a92f465166cd1b912d0248d28175b89215d8bf0
Opcode Fuzzy Hash: 5ead039ea019e468920b661798225550cc5a4065f9c0ad80161278c7ae253c2a
Instruction Fuzzy Hash: 97B18D32B0869686D774CBAAE064A7AB7A9FB48B84F014135DE4D67B95DF3DE840C700

Function 00007FFD93AC4FD0 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 215COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93AC5193
memcpy.VCRUNTIME140 ref: 00007FFD93AC51D8
memcpy.VCRUNTIME140 ref: 00007FFD93AC5249

Strings

virtual tables may not be altered, xrefs: 00007FFD93AC5067
sqlite_altertab_%s, xrefs: 00007FFD93AC519C
Cannot add a column to a view, xrefs: 00007FFD93AC5083

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy$memset
String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
API String ID: 438689982-2063813899
Opcode ID: 8e8ac9e6f7f0d28725a8b423da150783deef510d0755ecfafaba6123535020db
Instruction ID: 5505e19d496db90eaf36e1776dec4c1072ad55cd777e29c6fd8ebfd73c69723a
Opcode Fuzzy Hash: 8e8ac9e6f7f0d28725a8b423da150783deef510d0755ecfafaba6123535020db
Instruction Fuzzy Hash: 3891D262B09B8186EB64DF8AD4602B977E9FB44B84F454235EE8D57745EF3CD040C700

Function 00007FFD93A97550 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 214COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93A9760B
memcpy.VCRUNTIME140 ref: 00007FFD93A9769D
memcpy.VCRUNTIME140 ref: 00007FFD93A9771C

Strings

database corruption, xrefs: 00007FFD93A975D4
%s at line %d of [%.10s], xrefs: 00007FFD93A975E0
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A975C7

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 3510742995-3764764234
Opcode ID: b54bf69e1c0dc6cc5a72606d325a52d63276ec7ca94d9395c62e311e087d0bff
Instruction ID: 95d278c1a50fc1b9b1c2cf0419e7155555fef5e79f9db1f69231e4ba2114a389
Opcode Fuzzy Hash: b54bf69e1c0dc6cc5a72606d325a52d63276ec7ca94d9395c62e311e087d0bff
Instruction Fuzzy Hash: 5D910263B086C586CB30CB69D8902AABBA8FB44B88F448132DF8D63B15DF3DD555C750

Function 00007FFD93A96920 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 211COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93A96AD7
memcpy.VCRUNTIME140 ref: 00007FFD93A96B0F
memcpy.VCRUNTIME140 ref: 00007FFD93A96BDC

Strings

database corruption, xrefs: 00007FFD93A969CF
%s at line %d of [%.10s], xrefs: 00007FFD93A969D6
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A969BC

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 3510742995-3764764234
Opcode ID: 5c8ce51fa707764a8e0a8837a4120c8c93d1f4c97d6294696cbe41477e748cd0
Instruction ID: 61c58e4ae5d8751f8655ca53992241cbb19437e5fbf1e79039ba5854f914d46e
Opcode Fuzzy Hash: 5c8ce51fa707764a8e0a8837a4120c8c93d1f4c97d6294696cbe41477e748cd0
Instruction Fuzzy Hash: 8F91E572B082C19ADB24CB66D5602BD77E8FB40B94F048136DB8DA7AA5DF3CE564C740

Function 00007FF786888560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF786889216), ref: 00007FF786888592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF786889216), ref: 00007FF7868885E9

Part of subcall function 00007FF786889400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7868845E4,00000000,00007FF786881985), ref: 00007FF786889439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF786889216), ref: 00007FF786888678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF786889216), ref: 00007FF7868886E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF786889216), ref: 00007FF7868886F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF786889216), ref: 00007FF78688870A

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b2770b171440e78660be4c91fda42c27049aa369c6710ced6bdf6821ec2ad01d
Instruction ID: 87f552efd3625441346ac1bde6f992750101ce7c8356770f3e7217aeb4f7d7d1
Opcode Fuzzy Hash: b2770b171440e78660be4c91fda42c27049aa369c6710ced6bdf6821ec2ad01d
Instruction Fuzzy Hash: 3641B562B1868255EA30BB11AD446ABA3A4FF84FC4F944035DF4D97B89DF3CE911C720

Function 00007FF7868890E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF786888760: GetCurrentProcess.KERNEL32 ref: 00007FF786888780
Part of subcall function 00007FF786888760: OpenProcessToken.ADVAPI32 ref: 00007FF786888793
Part of subcall function 00007FF786888760: GetTokenInformation.ADVAPI32 ref: 00007FF7868887B8
Part of subcall function 00007FF786888760: GetLastError.KERNEL32 ref: 00007FF7868887C2
Part of subcall function 00007FF786888760: GetTokenInformation.ADVAPI32 ref: 00007FF786888802
Part of subcall function 00007FF786888760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF78688881E
Part of subcall function 00007FF786888760: CloseHandle.KERNEL32 ref: 00007FF786888836

LocalFree.KERNEL32(?,00007FF786883C55), ref: 00007FF78688916C
LocalFree.KERNEL32(?,00007FF786883C55), ref: 00007FF786889175

Strings

D:(A;;FA;;;%s), xrefs: 00007FF786889157
S-1-3-4, xrefs: 00007FF786889121
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF786889183
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF786889142

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction ID: ef3bf6fad5dbd0aa3349c71074ff84d0aa20490984f6e11aa704c6540b5942df
Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction Fuzzy Hash: FA214F25A08742A5FA10BB11ED153EBA265FF84B80FE44031EA4D53B86DF3CEC15C760

Function 00007FF78689B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA,?,?,?,?,00007FF7868971FF), ref: 00007FF78689B347
FlsSetValue.KERNEL32(?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA,?,?,?,?,00007FF7868971FF), ref: 00007FF78689B37D
FlsSetValue.KERNEL32(?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA,?,?,?,?,00007FF7868971FF), ref: 00007FF78689B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA,?,?,?,?,00007FF7868971FF), ref: 00007FF78689B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA,?,?,?,?,00007FF7868971FF), ref: 00007FF78689B3CC
SetLastError.KERNEL32(?,?,?,00007FF786894F81,?,?,?,?,00007FF78689A4FA,?,?,?,?,00007FF7868971FF), ref: 00007FF78689B3E7

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6c88e88182f069636ae7df0ba171e708af9cab9deaf2d86c464056bb8d47fe11
Instruction ID: d973d0eb85e2775bd28e3ce22eec01055da7de951f7a618c7075c8d04d351cf2
Opcode Fuzzy Hash: 6c88e88182f069636ae7df0ba171e708af9cab9deaf2d86c464056bb8d47fe11
Instruction Fuzzy Hash: 6C112F20A0C642ABF758B7315E5513FE1867F447A0FB48734D86E46AD6EE2CBC21D321

Function 00007FFDA3531F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3531FEA
memcpy.VCRUNTIME140 ref: 00007FFDA353202E
memcpy.VCRUNTIME140 ref: 00007FFDA3532123

Strings

src/raw_cfb.c, xrefs: 00007FFDA3531FDC
cfbState->usedKeyStream <= segment_len, xrefs: 00007FFDA3531FE3

Memory Dump Source

Source File: 00000002.00000002.3399927928.00007FFDA3531000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FFDA3530000, based on PE: true

Associated: 00000002.00000002.3399906871.00007FFDA3530000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399946107.00007FFDA3533000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399964219.00007FFDA3534000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399983040.00007FFDA3535000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3530000_shost.jbxd

Similarity

API ID: memcpy$_wassert
String ID: cfbState->usedKeyStream <= segment_len$src/raw_cfb.c
API String ID: 4178124637-977067101
Opcode ID: 190ca472f54348da95aaf15e0cc56e810afdec70c59e9a35399ab383c56dfc83
Instruction ID: 086777cd43012905f4f91702625a2eabf9b1b9c26ff020de50304e8d310add93
Opcode Fuzzy Hash: 190ca472f54348da95aaf15e0cc56e810afdec70c59e9a35399ab383c56dfc83
Instruction Fuzzy Hash: 4E5137A2F06FD182E60A8B2DE4245A96761FB54FD4F048A31DF9823B46EF3CD196C304

Function 00007FF786882910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF786881B6A), ref: 00007FF78688295E

Strings

[PYI-%d:ERROR] , xrefs: 00007FF786882966
Error, xrefs: 00007FF786882A0E
%s: %s, xrefs: 00007FF7868829E8
Error [ANSI Fallback], xrefs: 00007FF7868829FF

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: c53cf0ca2dd6ffdd1027e49762a4549e9f1a0e165130f18d4361c15acb5e1f0e
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: FF310822B1868166E720B761BC416E7A295BF88BD4F900132FE8D83759EF3CD966C310

Function 00007FF786882B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF78688918F,?,00007FF786883C55), ref: 00007FF786882BA0
MessageBoxW.USER32 ref: 00007FF786882C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF786882BA8
WARNING, xrefs: 00007FF786882BAF
Warning, xrefs: 00007FF786882C1D

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: fc67fdc945d40235a9f4750c750f646c2808b8f9528543974b28c7f8085a8d23
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: A321D162708B41A6E710AB15F8447ABB7A4FB887C4F900132EE8D53659DE3CDA25C750

Function 00007FF786882710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF786881B99), ref: 00007FF786882760

Strings

ERROR, xrefs: 00007FF78688276F
Error, xrefs: 00007FF7868827DE
[PYI-%d:%s] , xrefs: 00007FF786882768
Error [ANSI Fallback], xrefs: 00007FF7868827CF

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: 1fc03723e7ae4b43991be68509645ee2bb179d24d2abfe68550d8f393fdcc785
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: B8218132A18781A6E720EB51BC817E7A7A4FB887C4F900131EE8D53659DF3CD955C750

Function 00007FFD93BE4C58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFD93BE4C84
_PyUnicode_ToNumeric.PYTHON312 ref: 00007FFD93BE4CB7
PyErr_SetString.PYTHON312 ref: 00007FFD93BE4CDF
PyFloat_FromDouble.PYTHON312 ref: 00007FFD93BE4CF7

Strings

not a numeric character, xrefs: 00007FFD93BE4CD5

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
String ID: not a numeric character
API String ID: 1034370217-2058156748
Opcode ID: 7ac3b2fdf3478d2374b08fe415c3a12b63c61252479e25d1cab849eb02e47f53
Instruction ID: 6616c186622aedbef8a5fca8ba9d598a0656a278a136d6c84ee0d50e4c70b415
Opcode Fuzzy Hash: 7ac3b2fdf3478d2374b08fe415c3a12b63c61252479e25d1cab849eb02e47f53
Instruction Fuzzy Hash: 24216021F0C96281EB758BADD43013A63E8AF44B8CF148431CA9E77754DF6CE8859782

Function 00007FFD93BE4354 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FFD93BE4380
_PyUnicode_ToDecimalDigit.PYTHON312 ref: 00007FFD93BE439F
PyErr_SetString.PYTHON312 ref: 00007FFD93BE43BF
PyLong_FromLong.PYTHON312 ref: 00007FFD93BE43D9

Strings

not a decimal, xrefs: 00007FFD93BE43B5

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
String ID: not a decimal
API String ID: 3750391552-3590249192
Opcode ID: babd95680f3a021cdbe90a8980b0a1372c723c98da362c4ed99ce49efb4cea9f
Instruction ID: e55f3e7bc9d7d20291e935c13b297c51923decac94a8cdfdf791cf36ac9bc32d
Opcode Fuzzy Hash: babd95680f3a021cdbe90a8980b0a1372c723c98da362c4ed99ce49efb4cea9f
Instruction Fuzzy Hash: D5115425B0864281FB758F9EE47413E6399EF44B8CF844435CA8EA7654DF2CE9548382

Function 00007FFD93BE4BA4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFD93BE4BDF
_PyArg_BadArgument.PYTHON312 ref: 00007FFD93BE4C14

Strings

numeric, xrefs: 00007FFD93BE4BD8, 00007FFD93BE4C06
argument 1, xrefs: 00007FFD93BE4C0D
a unicode character, xrefs: 00007FFD93BE4BFF

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$numeric
API String ID: 3876575403-2385192657
Opcode ID: bbdd109889d573d2d770b99f749a56ec45e44fab925d66d6427c2491f45a32cb
Instruction ID: 4b9466f709e10c5f9e54bfc044ca5159221548d1bcb5f759ad9d303b8f1ce444
Opcode Fuzzy Hash: bbdd109889d573d2d770b99f749a56ec45e44fab925d66d6427c2491f45a32cb
Instruction Fuzzy Hash: 0111B231B08A9685EB309F9AE8501AA7328FB44BC8F484032DA8D67754CF3DE585C341

Function 00007FFD93BE42A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON312 ref: 00007FFD93BE42DB
_PyArg_BadArgument.PYTHON312 ref: 00007FFD93BE4310

Strings

argument 1, xrefs: 00007FFD93BE4309
a unicode character, xrefs: 00007FFD93BE42FB
decimal, xrefs: 00007FFD93BE42D4, 00007FFD93BE4302

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: a unicode character$argument 1$decimal
API String ID: 3876575403-2474051849
Opcode ID: 1e4fff75323d13296d4f9873b31303b2eb894daa88b12eee96b04a04f0936518
Instruction ID: b3ce495a93a727c39b3d111b22c66ef4453668ff589fb47e1a46a187ec72eb03
Opcode Fuzzy Hash: 1e4fff75323d13296d4f9873b31303b2eb894daa88b12eee96b04a04f0936518
Instruction Fuzzy Hash: 52118231F08A8286EB70DF9AE4511AE7368EB84B88F984032DA9D67755CF3CE585C741

Function 00007FFD93BE41B4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FFD93BE41E4
PyErr_Occurred.PYTHON312 ref: 00007FFD93BE4213

Strings

argument, xrefs: 00007FFD93BE41D6
a unicode character, xrefs: 00007FFD93BE41CF
combining, xrefs: 00007FFD93BE41DD

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Arg_ArgumentErr_Occurred
String ID: a unicode character$argument$combining
API String ID: 3979797681-4202047184
Opcode ID: 23a79bd7f21a28e7400453b17a2d46dedd5221c58aaec7069aa9642920e7cd67
Instruction ID: 278469b40308388a15c13e03cdcd80681bdfcdda37a3655a21815f6814cab861
Opcode Fuzzy Hash: 23a79bd7f21a28e7400453b17a2d46dedd5221c58aaec7069aa9642920e7cd67
Instruction Fuzzy Hash: DF01F720F0CA4381EE348BD9E8700BA23A8FF4974CF400631C58D67280CE3CE9848392

Function 00007FFD93BE2630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON312(?,?,00000000,00007FFD93BE256A), ref: 00007FFD93BE263B
PyCapsule_New.PYTHON312(?,?,00000000,00007FFD93BE256A), ref: 00007FFD93BE2678
PyErr_NoMemory.PYTHON312(?,?,00000000,00007FFD93BE256A), ref: 00007FFD93BE3EC8
PyMem_Free.PYTHON312(?,?,00000000,00007FFD93BE256A), ref: 00007FFD93BE3ED8

Strings

unicodedata._ucnhash_CAPI, xrefs: 00007FFD93BE266D

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Mem_$Capsule_Err_FreeMallocMemory
String ID: unicodedata._ucnhash_CAPI
API String ID: 3673501854-3989975041
Opcode ID: 89b48c636968bcc96ff5c1323bcf06e5fb317347bf56e69214e0fa8ba2ac5adf
Instruction ID: aee1c7ba326e990ee55e523e0fb1788f78f1bb9f2ad0114f87d890185e2e3ffd
Opcode Fuzzy Hash: 89b48c636968bcc96ff5c1323bcf06e5fb317347bf56e69214e0fa8ba2ac5adf
Instruction Fuzzy Hash: 03F03125B09B4795EB355B99E42407863ACBF08788F441436C8CE26354EF3CE044C3D2

Function 00007FF786899AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF786899B1D
GetProcAddress.KERNEL32 ref: 00007FF786899B33
FreeLibrary.KERNEL32 ref: 00007FF786899B5A

Strings

CorExitProcess, xrefs: 00007FF786899B2C
mscoree.dll, xrefs: 00007FF786899B14

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: b017633bd496a61cec96040c0e4381d273a6e12fb44abfc8e903c4988d0ff04a
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: BEF04F21A09606A1EA10AB25AC5537BA361BF45762FE80235DA6E461E4DF2CE854C321

Function 00007FFD93AAB052 Relevance: 8.0, APIs: 1, Strings: 4, Instructions: 485COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93AAB4D9

Strings

string or blob too big, xrefs: 00007FFD93AAFC85
out of memory, xrefs: 00007FFD93AAFFBB
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93AAFA92, 00007FFD93AAFDF0
statement aborts at %d: [%s] %s, xrefs: 00007FFD93AB005F

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: 831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$out of memory$statement aborts at %d: [%s] %s$string or blob too big
API String ID: 3510742995-1759904473
Opcode ID: c10001b18d4b9dfcf1cf0e985a24e71068a2eefeee13fc4e9f3a977b5c8b3c96
Instruction ID: 376228d30328cc99bfb803c79236c05a07cbcad658c7018d7e23dc4a1ab59549
Opcode Fuzzy Hash: c10001b18d4b9dfcf1cf0e985a24e71068a2eefeee13fc4e9f3a977b5c8b3c96
Instruction Fuzzy Hash: D0326033B0868286E724CFA6D46427D77EAFB45B88F104136DA4DA7B95DF39E841CB40

Function 00007FFD93A99CD0 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 385COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93A9A12D

Strings

database corruption, xrefs: 00007FFD93A99E9A
%s at line %d of [%.10s], xrefs: 00007FFD93A99EA1
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A99E81

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 3510742995-3764764234
Opcode ID: 7ecc235ea456a3517d98c30b4aafd094949fe84128b0cda5505748e299ff0bcd
Instruction ID: 05311905e823af7b81c1a1c13e9b3b75ed60c2bd0e96a39d08d874401db84e1f
Opcode Fuzzy Hash: 7ecc235ea456a3517d98c30b4aafd094949fe84128b0cda5505748e299ff0bcd
Instruction Fuzzy Hash: A4F1D422B086A296EB34CBA5D4606BD27E9FB04B98F144136DE4D77794DF3CE881C341

Function 00007FFD93B0AB30 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 381COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93B0ABCF

Strings

hidden, xrefs: 00007FFD93B0AF8D
vtable constructor failed: %s, xrefs: 00007FFD93B0AD1B
vtable constructor called recursively: %s, xrefs: 00007FFD93B0ACD6
vtable constructor did not declare schema: %s, xrefs: 00007FFD93B0AE4A

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
API String ID: 3510742995-1299490920
Opcode ID: 2623641340c733b794af5866e5bcb4bdb6316ec65f5e7f2dcf12a73dcdb92bb2
Instruction ID: 9107c2fbf6d4cfce602ebdb9601c031109b543bfaf683f04025f22608388c58b
Opcode Fuzzy Hash: 2623641340c733b794af5866e5bcb4bdb6316ec65f5e7f2dcf12a73dcdb92bb2
Instruction Fuzzy Hash: A1F1CD72B08B8281EB60CB95D5A437A77A9FB44B98F444236DE9E67799DF3CE441C300

Function 00007FFD93A8DF00 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 381COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 00007FFD93A8DF52

Strings

database corruption, xrefs: 00007FFD93A8E123
%s at line %d of [%.10s], xrefs: 00007FFD93A8E12F
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A8E116
3|r<, xrefs: 00007FFD93A8DF17

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcmp
String ID: %s at line %d of [%.10s]$3|r<$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 1475443563-3945487598
Opcode ID: 62f54c23268b50f86930106d177abfa006e42ef718a6c5b789f12609d796c0a1
Instruction ID: 5659b883db4b9fc56d7f86311ff5eba8640756219f1b88850d6a9a2238163537
Opcode Fuzzy Hash: 62f54c23268b50f86930106d177abfa006e42ef718a6c5b789f12609d796c0a1
Instruction Fuzzy Hash: EAF16D72B04642DBEB64CBA9D560AAD77A9FB44B88B005035DF0DA7B94DF38E825C740

Function 00007FFD93A9A210 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 367COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93A9A36A
memcpy.VCRUNTIME140 ref: 00007FFD93A9A4BF

Strings

database corruption, xrefs: 00007FFD93A9A313, 00007FFD93A9A457
%s at line %d of [%.10s], xrefs: 00007FFD93A9A31F, 00007FFD93A9A463
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A9A306, 00007FFD93A9A44A

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 3510742995-3764764234
Opcode ID: d4e4235366397ffa4192c27ec5a3839622ea780d7ff69d8c2b7ff8da986cbc16
Instruction ID: 4f34c1a50489977c783676d1e22297ff867f9aa0599686c238befb83c2d8b287
Opcode Fuzzy Hash: d4e4235366397ffa4192c27ec5a3839622ea780d7ff69d8c2b7ff8da986cbc16
Instruction Fuzzy Hash: 1BF1BA36708B8186D7A08B95E4547AE77A8FB85B88F108036EF8E67795DF3DE484C701

Function 00007FFD93A95C10 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93A95D24
memset.VCRUNTIME140 ref: 00007FFD93A95EB7

Strings

database corruption, xrefs: 00007FFD93A9605E
%s at line %d of [%.10s], xrefs: 00007FFD93A9606A
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A96051

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 2221118986-3764764234
Opcode ID: ba5d2802316911a7491cadce116daa97ccd6123211c9d747203731b79c4598ca
Instruction ID: ee63a606586af2f3de3fdd9b68264151a3ed719fdab4bffa9eeeece883ec74b0
Opcode Fuzzy Hash: ba5d2802316911a7491cadce116daa97ccd6123211c9d747203731b79c4598ca
Instruction Fuzzy Hash: 11D1CF33B0978586DB64CF66E4256A977A8FB88B98F05803ADF8D67790DF39D441C300

Function 00007FFD93AF5FB0 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,00000000,?,00000000,?,00000000,?,?,00000000,00007FFD93AF685C,?,?,?), ref: 00007FFD93AF6030
memcpy.VCRUNTIME140(?,?,?,?,00000000,?,00000000,?,00000000,?,?,00000000,00007FFD93AF685C,?,?,?), ref: 00007FFD93AF6177

Strings

rowid, xrefs: 00007FFD93AF6108
column%d, xrefs: 00007FFD93AF6185
%.*z:%u, xrefs: 00007FFD93AF6247

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpymemset
String ID: %.*z:%u$column%d$rowid
API String ID: 1297977491-2903559916
Opcode ID: 08510bc2f91bb91ca6b150f206b5e176198501868962b9f272200c2a936f9cd2
Instruction ID: ba89eac34b5706573176ca13ba85e3839a34549e67f361a4c62063ea1f77521f
Opcode Fuzzy Hash: 08510bc2f91bb91ca6b150f206b5e176198501868962b9f272200c2a936f9cd2
Instruction Fuzzy Hash: B9C10422F0878289EA75DB9595643B967A8FF45B98F488235DE4D277E5DF3CE401C300

Function 00007FFD93A992B0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD93A97BA0: memcpy.VCRUNTIME140 ref: 00007FFD93A97C0C
Part of subcall function 00007FFD93A97BA0: memcpy.VCRUNTIME140 ref: 00007FFD93A97C33

memcpy.VCRUNTIME140 ref: 00007FFD93A9951F
memcpy.VCRUNTIME140 ref: 00007FFD93A99535

Strings

database corruption, xrefs: 00007FFD93A9936A
%s at line %d of [%.10s], xrefs: 00007FFD93A99371
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A99351

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 3510742995-3764764234
Opcode ID: 898f60ba5d30a691837549c26709609510d03b6403a49f9c5c703c2500f0ffd9
Instruction ID: a457c1cc32c80ddcb70c904fb86e7664c6f8ba5b2f92674e3beca07193577656
Opcode Fuzzy Hash: 898f60ba5d30a691837549c26709609510d03b6403a49f9c5c703c2500f0ffd9
Instruction Fuzzy Hash: 0F81E132B0879197E765CBA6D4647AE77AAFB48B84F00803ADB4E67791DF38E445C700

Function 00007FFD93A96C20 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 191COMMON

Download Yara Rule

Strings

database corruption, xrefs: 00007FFD93A96CDF
%s at line %d of [%.10s], xrefs: 00007FFD93A96CE6
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A96CCC

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 0-3764764234
Opcode ID: d7bbc113d95c405dff7a55cfefdeaeb98036685461038bdd9bca21eed79271cd
Instruction ID: 10a0bc04114179b20b03e94453c648425a43675c78f9bd8d8f40e24fddea02ce
Opcode Fuzzy Hash: d7bbc113d95c405dff7a55cfefdeaeb98036685461038bdd9bca21eed79271cd
Instruction Fuzzy Hash: A281E122B086D15EEB308B65D1A02BE7BA8FF40B94F044136DB9977695DF3CE455C740

Function 00007FFD93B09480 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 158stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000001,?,00000000,00000000,00007FFD93B09718,?,?,?,00007FFD93B09AA8), ref: 00007FFD93B095D7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000001,?,00000000,00000000,00007FFD93B09718,?,?,?,00007FFD93B09AA8), ref: 00007FFD93B095F1
memcpy.VCRUNTIME140(?,?,?,?,00000001,?,00000000,00000000,00007FFD93B09718,?,?,?,00007FFD93B09AA8), ref: 00007FFD93B09688

Strings

INS, xrefs: 00007FFD93B095E7
CRE, xrefs: 00007FFD93B095CD

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: strncmp$memcpy
String ID: CRE$INS
API String ID: 2549481713-4116259516
Opcode ID: e12567ddb0f196b07d9f5e4ba21f0b7ea7bdba06f3ad636a4e3b0586bce67617
Instruction ID: 7360bb87618108ad226cede178dfef8028d1c96d385c38155b972d9423aa9839
Opcode Fuzzy Hash: e12567ddb0f196b07d9f5e4ba21f0b7ea7bdba06f3ad636a4e3b0586bce67617
Instruction Fuzzy Hash: 3A518E21B0D74281EA749B96D47027A63AABF81FD8F544235CEDD677E9DE3DE4028340

Function 00007FFD93A96F20 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93A96FA9
memcpy.VCRUNTIME140 ref: 00007FFD93A97085

Strings

database corruption, xrefs: 00007FFD93A97135
%s at line %d of [%.10s], xrefs: 00007FFD93A97141
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A97129

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 3510742995-3764764234
Opcode ID: b58e67e868266958ee63fae97e30cea9948d32f85de2d97240c8beaf73649289
Instruction ID: 6e61ee7dcc7007707c47691561a32d238c704442da582f1e7d7cfc14749a9326
Opcode Fuzzy Hash: b58e67e868266958ee63fae97e30cea9948d32f85de2d97240c8beaf73649289
Instruction Fuzzy Hash: C4512272708BD186CB20CB4AE4609AE7BA9F744B84F15413AEA8E23754DF3DD451CB20

Function 00007FFD93A9DEF0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93A9E023

Strings

, xrefs: 00007FFD93A9E042
%!.15g, xrefs: 00007FFD93A9E06C
3|r<, xrefs: 00007FFD93A9DEFA
-, xrefs: 00007FFD93A9E007

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: $%!.15g$-$3|r<
API String ID: 3510742995-617294525
Opcode ID: d02df9ab0000bbca719244b57a9d91f3d0f1933245798ee1348dd601c613165e
Instruction ID: 581210b175b92f55884dd945597e1ad96c8eed6763b82a38e0a8e421c35a0bc3
Opcode Fuzzy Hash: d02df9ab0000bbca719244b57a9d91f3d0f1933245798ee1348dd601c613165e
Instruction Fuzzy Hash: 62410362B1C78582EB20CB6EE0617AA7BA4EB95BC4F004135EE8E27796CB3DD505C700

Function 00007FFD93A7C960 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93A7C9A4
memcpy.VCRUNTIME140 ref: 00007FFD93A7C9CD
memset.VCRUNTIME140 ref: 00007FFD93A7CAE4

Strings

winRead, xrefs: 00007FFD93A7CA78
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FFD93A7CAB9

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy$memset
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 438689982-1843600136
Opcode ID: 741b0e31e271a6a920d8f7a77574a081f4792607e0774ba0d9e6d6aca4af2089
Instruction ID: 87381da3043a1c3d0ce0b84ae6d9ab66c232e7a77ed267dd33d555f1325651c5
Opcode Fuzzy Hash: 741b0e31e271a6a920d8f7a77574a081f4792607e0774ba0d9e6d6aca4af2089
Instruction Fuzzy Hash: 7F412836F08A4686E630DF99E4904A9B36AFB44B89F544136DE8E637A4DF3CE542C340

Function 00007FFDA35323F0 Relevance: 7.6, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA353245E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3532478
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3532490
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35324A3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA35324AC
memcpy.VCRUNTIME140 ref: 00007FFDA35324E9

Memory Dump Source

Source File: 00000002.00000002.3399927928.00007FFDA3531000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FFDA3530000, based on PE: true

Associated: 00000002.00000002.3399906871.00007FFDA3530000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399946107.00007FFDA3533000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399964219.00007FFDA3534000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000002.00000002.3399983040.00007FFDA3535000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffda3530000_shost.jbxd

Similarity

API ID: calloc$free$memcpy
String ID:
API String ID: 3937003943-0
Opcode ID: 9bc8d67156ad3f452768cdaea32a448c3d61317b4a210aaa2a65c8f186b35c59
Instruction ID: 179096aae1ad8f9424a3a387c590fe351db585fe326f250bae88ee30d8649ad3
Opcode Fuzzy Hash: 9bc8d67156ad3f452768cdaea32a448c3d61317b4a210aaa2a65c8f186b35c59
Instruction Fuzzy Hash: F431733170AF4182EB1A8B19F47036822A2FF54F90F148835DE9C1774ADF3ED4958345

Function 00007FF7868A93D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7868A9400
_set_statfp.LIBCMT ref: 00007FF7868A941B
_set_statfp.LIBCMT ref: 00007FF7868A9437
_set_statfp.LIBCMT ref: 00007FF7868A9473

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: d3786464e3e0c3334d5dbf39440754ad19e0c6c7e1c1d494ccb5b90287d131a1
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 76119062E7DA1221FF743126DC96377A0447F58362EA40634EF7E062D6CE2CEC61C122

Function 00007FF78689B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF78689A613,?,?,00000000,00007FF78689A8AE,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689B41F
FlsSetValue.KERNEL32(?,?,?,00007FF78689A613,?,?,00000000,00007FF78689A8AE,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689B43E
FlsSetValue.KERNEL32(?,?,?,00007FF78689A613,?,?,00000000,00007FF78689A8AE,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689B466
FlsSetValue.KERNEL32(?,?,?,00007FF78689A613,?,?,00000000,00007FF78689A8AE,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689B477
FlsSetValue.KERNEL32(?,?,?,00007FF78689A613,?,?,00000000,00007FF78689A8AE,?,?,?,?,?,00007FF78689A83A), ref: 00007FF78689B488

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
Instruction ID: 4c0d77788fa23747d89523d1bcbeaa6265704e9d7ba86dfdc7cb4fcc0a1a4e7c
Opcode Fuzzy Hash: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
Instruction Fuzzy Hash: 0C116320A086026AFA68B3216D5117BE1467F447B0FF88334E87D566D6EE2CBC21D720

Function 00007FF78689B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF78689B2A5
FlsSetValue.KERNEL32 ref: 00007FF78689B2C4
FlsSetValue.KERNEL32 ref: 00007FF78689B2EC
FlsSetValue.KERNEL32 ref: 00007FF78689B2FD
FlsSetValue.KERNEL32 ref: 00007FF78689B30E

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8aa69c65082f5ed190463b1c2d732539134b8ecb86da000f77e4666776fecf75
Instruction ID: a36a426d07d9f36da92833db1230d073858e7cfbd2803bcea330342786a34fb1
Opcode Fuzzy Hash: 8aa69c65082f5ed190463b1c2d732539134b8ecb86da000f77e4666776fecf75
Instruction Fuzzy Hash: C2110620A092066AFA68B3715C1517FA1867F49760FF88734D93E5A6C2FE2CBC21D321

Function 00007FF786896010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78689604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF786896176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78689622C

Strings

verbose, xrefs: 00007FF786896020

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 0660798fe3960bab89680a2b0d589c6e1ad8bd9d5274ff5b9316a77fea504db3
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 5091CC32A08A46A5F721AF64DC50B7EB291BB45B94FE44132DA4D432C5EE3CFCA5C320

Function 00007FF78689FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78689FF17

Part of subcall function 00007FF786897AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF786897AC9

Strings

UTF-8, xrefs: 00007FF78689FE96
ccs, xrefs: 00007FF78689FE52
UTF-16LEUNICODE, xrefs: 00007FF78689FEB5

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: 4db75222d53dfbcf1cb667d084fc93df46b78851541aea7b0f042cbce59aba4e
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: A8818132E0C242A5F76C6F25895027EB6A0BF11748FF58035DA0E97695EB2DFD21D321

Function 00007FF78688D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF78688D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF78688D77A
RtlUnwindEx.KERNEL32 ref: 00007FF78688D7D4

Strings

csm, xrefs: 00007FF78688D761

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: bd804a114ffd2138a2a590143e07f77face305f3f50390ad30ed311141d8c71b
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 2651A132B19602AADB54AF15E844A3AB7A1FB44F98FA44530DE4D47B48DF7CEC61CB10

Function 00007FF78688EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF78688EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF78688EFF3

Strings

RCC, xrefs: 00007FF78688EFC3
MOC, xrefs: 00007FF78688EFBB

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: feac780e042bdbf1c920995d476569db75c97600e2984dc9a20f3f67f8c0bf5d
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 5961C172908BC596E731AB15E8403AAF7A0FB84BC4F544225EB8C07B99DF7CD5A0CB10

Function 00007FF78688F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF78688F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF78688F408

Strings

csm, xrefs: 00007FF78688F45A
csm, xrefs: 00007FF78688F342

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: fa07fca1383a16e3a5e807b89b117cea1d8e17d731c49545448e81e18dbada54
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: 6D518032908382D6EB74AF21994427AB6A0FB94FD4FA48136DA5D47795CF3CEC60C711

Function 00007FF786887E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF78688352C,?,00000000,00007FF786883F23), ref: 00007FF786887F22

Strings

%.*s, xrefs: 00007FF786887EDB
\, xrefs: 00007FF786887E87
%s%c, xrefs: 00007FF786887E94

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
Instruction ID: 0e615587edf77ffd1bd11e1794e7ee4dbe2f48831fa020e9eafb92a69419043b
Opcode Fuzzy Hash: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
Instruction Fuzzy Hash: 2831D821619AC165EA21AB11EC507EBA364FF94FE4F940231EE6D43BC9DE2CDA11C710

Function 00007FF786882810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7868828EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF786882868
Error, xrefs: 00007FF7868828DD
ERROR, xrefs: 00007FF78688286F

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: bafd3ef12296ebc86a1710abba9c39545a6822f2eac066062a24186dab257bcb
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: 3921D162B08B41A6E710AB15F8447EBB7A1FB88784F900132EE8D53659DF3CDA65C750

Function 00007FFD93B9CAD0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(?,?,?,?,?,?,00007FFD93A78ECA), ref: 00007FFD93B9CB32
capture_previous_context.LIBCMT ref: 00007FFD93B9CB4A
__raise_securityfailure.LIBCMT ref: 00007FFD93B9CBEC

Strings

3|r<, xrefs: 00007FFD93B9CBC4

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: FeaturePresentProcessor__raise_securityfailurecapture_previous_context
String ID: 3|r<
API String ID: 838830666-173920056
Opcode ID: bc9e85577e0c5d4c5e40581d76414b7e5655eccd442f4b2c7b94972861003e75
Instruction ID: 7c1c0a2fbf145c2201b54afabc71a53a33b494f9ff3b6fe9bf4cf0b44d2e5fd0
Opcode Fuzzy Hash: bc9e85577e0c5d4c5e40581d76414b7e5655eccd442f4b2c7b94972861003e75
Instruction Fuzzy Hash: DB21AE65B08B06C1FA70EB9CF87126966A8FB8434DF940136D9CEA67A5DF7CA445C700

Function 00007FFD93BE1EF0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312(?,?,?,?,?,00007FFD93BE1EDC), ref: 00007FFD93BE3B31

Part of subcall function 00007FFD93BE1FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD93BE2008
Part of subcall function 00007FFD93BE1FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD93BE2026

PyErr_Format.PYTHON312 ref: 00007FFD93BE1F53

Strings

undefined character name '%s', xrefs: 00007FFD93BE1F46
name too long, xrefs: 00007FFD93BE3B27

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Err_strncmp$FormatString
String ID: name too long$undefined character name '%s'
API String ID: 3882229318-4056717002
Opcode ID: fe9fd46e1f898954a40cc435b1b2d9c6909a3f099c322250393b7a83e7c0a7cf
Instruction ID: eb3ab6021e209c01916165b32a4ace3501524ba461cc33472f7c459e559ad67c
Opcode Fuzzy Hash: fe9fd46e1f898954a40cc435b1b2d9c6909a3f099c322250393b7a83e7c0a7cf
Instruction Fuzzy Hash: 65112175F1894791EB308B9CD4A42B86368FB8874DF900432CA4D562A1DF6DE54AC782

Function 00007FFD93AD1000 Relevance: 6.3, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93AD1060
memcpy.VCRUNTIME140 ref: 00007FFD93AD1075
memcpy.VCRUNTIME140 ref: 00007FFD93AD1099
memcpy.VCRUNTIME140 ref: 00007FFD93AD10B8
memcpy.VCRUNTIME140 ref: 00007FFD93AD10D0

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: db1eac4d454e902911ea1b1a34f60bb4e209e0ef3d5718293bc999cea4fc789d
Instruction ID: 9d5772ce87263d2efb577197c33c94f8470931440d49cd61f317ec541a9f7cf3
Opcode Fuzzy Hash: db1eac4d454e902911ea1b1a34f60bb4e209e0ef3d5718293bc999cea4fc789d
Instruction Fuzzy Hash: BB215966B1879183DA74AB5BF5510BAB2A5FB44BC8B085135DBDE57FA6CF2CE050C200

Function 00007FF78689C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF78689C68F
WriteFile.KERNEL32 ref: 00007FF78689C957
WriteFile.KERNEL32 ref: 00007FF78689C99D
GetLastError.KERNEL32 ref: 00007FF78689CA53

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: 5d6d95c92dcbc0a395b4781f538883abcc10579904d58b12b1638d7d547bb12b
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: FCD14972B186809AE710DF65D8403ED77B1FB44798FA08235CE5D67B89EE39E826C350

Function 00007FFD93A7DBB0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 249COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93A7DC3C

Strings

winOpenShm, xrefs: 00007FFD93A7DE49
%s-shm, xrefs: 00007FFD93A7DC53
readonly_shm, xrefs: 00007FFD93A7DDDA

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memset
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 2221118986-2815843928
Opcode ID: 8d2a6488cfe544708466a8bb6c48c74f0afd239d4f67e3118775d9e63ad55e06
Instruction ID: 12732eedc67d454b7041b0127e7bff38f44d9a7e51f8f8ba41bc4a375f1279a3
Opcode Fuzzy Hash: 8d2a6488cfe544708466a8bb6c48c74f0afd239d4f67e3118775d9e63ad55e06
Instruction Fuzzy Hash: C2C16E21F09A4286EA74EBA9E4B467937A8FF84B59F044235CA9F67291DF3CE445C340

Function 00007FFD93B042F0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,00000080,?,00000000,00007FFD93B047C2), ref: 00007FFD93B0449B
memcpy.VCRUNTIME140(?,?,?,?,?,?,00000080,?,00000000,00007FFD93B047C2), ref: 00007FFD93B0451E
memcpy.VCRUNTIME140(?,?,?,?,?,?,00000080,?,00000000,00007FFD93B047C2), ref: 00007FFD93B0460B

Strings

RETURNING may not use "TABLE.*" wildcards, xrefs: 00007FFD93B04371

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: RETURNING may not use "TABLE.*" wildcards
API String ID: 3510742995-2313493979
Opcode ID: 6bac7e3f1474ddabb9d0e3377e88d9ee408727fdfbaf5356aee17a161c2ff753
Instruction ID: 82436cbf650bf093f7973f0dbe333a75b95c39631d576487cfc7b798ab66169a
Opcode Fuzzy Hash: 6bac7e3f1474ddabb9d0e3377e88d9ee408727fdfbaf5356aee17a161c2ff753
Instruction Fuzzy Hash: C8B19D22B08B8185EB20CF55E5502BE77A4FB85BA8F458235DEAD277D9DF38E154C700

Function 00007FFD93A8FCD0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93A8FEF9

Strings

database corruption, xrefs: 00007FFD93A8FD93, 00007FFD93A8FF2A
%s at line %d of [%.10s], xrefs: 00007FFD93A8FD9F, 00007FFD93A8FF36
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A8FD87, 00007FFD93A8FF1D

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 2221118986-3764764234
Opcode ID: ecbb86cd0e9d029091757095cef891f97430be387d8a3809b0bb42ac0724bbd6
Instruction ID: c21a3667cd72b82164c5eecb15941507f7718268201f8c9748f107cd4b65852c
Opcode Fuzzy Hash: ecbb86cd0e9d029091757095cef891f97430be387d8a3809b0bb42ac0724bbd6
Instruction Fuzzy Hash: 09813523B082E24AE3358B65F4605FE3A98E711799F45413AEFCA97281DA3CD986D310

Function 00007FF78689CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78689CFBB), ref: 00007FF78689D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78689CFBB), ref: 00007FF78689D177

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: 314405e92c54fe47af876ef52776881fa842567d37adf484145b950fdbd80306
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 5E910E32F18A51A5F750AF659C4027EABA0BB45788FB44135DE0D53686EE3CFC62CB24

Function 00007FFD93B0C120 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93B0C285

Part of subcall function 00007FFD93A786C0: memcpy.VCRUNTIME140(?,?,%s at line %d of [%.10s],00007FFD93A780C1), ref: 00007FFD93A786F1

Strings

AND , xrefs: 00007FFD93B0C15C, 00007FFD93B0C177
rowid, xrefs: 00007FFD93B0C254
<expr>, xrefs: 00007FFD93B0C219

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: AND $<expr>$rowid
API String ID: 3510742995-4041574714
Opcode ID: b4c2be6d6d7564caef385a3f93df3024368e737422d76fa75132c6b25b563662
Instruction ID: 01ed6b8bbe868bb9cd167d18369196eabfbbcf064a70ea4a8f0e38825225533c
Opcode Fuzzy Hash: b4c2be6d6d7564caef385a3f93df3024368e737422d76fa75132c6b25b563662
Instruction Fuzzy Hash: F0A1D136B086468AEB28CFA9D4A153C37A5FB55B9CF544035DA8E5B398DF3CE841C740

Function 00007FFD93AF5C50 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 197COMMON

Download Yara Rule

Strings

rowid, xrefs: 00007FFD93AF5DAE
%s.%s, xrefs: 00007FFD93AF5DCE
column%d, xrefs: 00007FFD93AF5E58

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID:
String ID: %s.%s$column%d$rowid
API String ID: 0-1505470444
Opcode ID: d1fe2ab18ba4c5494ba92163807286c015e8439aac513501ae0b7842bd63adfc
Instruction ID: 0d9229e9170eb64a72add1169fa724c7dd6df566528a528556b37bb2b62f0d4b
Opcode Fuzzy Hash: d1fe2ab18ba4c5494ba92163807286c015e8439aac513501ae0b7842bd63adfc
Instruction Fuzzy Hash: 0791A832B08B8185EA30CB55E8643A967A8FB45BB8F144326DEAD673D5DF3CE441C700

Function 00007FFD93AD0D70 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93AD0F9E

Strings

, xrefs: 00007FFD93AD0E4D
CREATE TABLE , xrefs: 00007FFD93AD0E8F
, , xrefs: 00007FFD93AD0E2E

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: $, $CREATE TABLE
API String ID: 3510742995-3459038510
Opcode ID: 2081a2dbc97168acd8cf1a833345e11573e5a6da12cc66ba4e09f63b3e37b920
Instruction ID: 7bfbcbd752fca07c3828a7c0add3b1e363e3ed10b2ed013e5ee3a3ff71a4d7a8
Opcode Fuzzy Hash: 2081a2dbc97168acd8cf1a833345e11573e5a6da12cc66ba4e09f63b3e37b920
Instruction Fuzzy Hash: E5610762B0868186DB25CF65E4602B9B7AAFB44BA8F484335DAAD577D1DF3CE446C300

Function 00007FFD93A890D0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 176COMMON

Download Yara Rule

Strings

database corruption, xrefs: 00007FFD93A8910B, 00007FFD93A89267
%s at line %d of [%.10s], xrefs: 00007FFD93A89112, 00007FFD93A8926E
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A890F2, 00007FFD93A8924E

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 0-3764764234
Opcode ID: a3f4963bf6badd5094b6f77c9a0bd31b2dca0af386d68f606f0576783d0880ce
Instruction ID: 38c85e4f32bc4e3235e63c250033845df125af6552b9c11497d666d6f0015434
Opcode Fuzzy Hash: a3f4963bf6badd5094b6f77c9a0bd31b2dca0af386d68f606f0576783d0880ce
Instruction Fuzzy Hash: 23713031B0864686FBB49B96E46437977AAFB84B84F144039DF4E676A5EF3CE851C300

Function 00007FFD93BE1FD0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD93BE2008
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFD93BE2026

Strings

CJK UNIFIED IDEOGRAPH-, xrefs: 00007FFD93BE201C
HANGUL SYLLABLE , xrefs: 00007FFD93BE1FF5

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: strncmp
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 1114863663-87138338
Opcode ID: d800521c55394c3ad25b6a38125f6762d0e11982fd6218b3e6ef33505340922b
Instruction ID: 72bbaaf210bf41d338dbab779df79be443080637c461cd7b3e68f5309ef9f10f
Opcode Fuzzy Hash: d800521c55394c3ad25b6a38125f6762d0e11982fd6218b3e6ef33505340922b
Instruction Fuzzy Hash: 1A617B32B1824246E6749B5DE81067E725AFF80B98F444231EADE5B7C5DF3CD5018782

Function 00007FFD93AD66C0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

index '%q', xrefs: 00007FFD93AD6712
, , xrefs: 00007FFD93AD6745

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID:
String ID: , $index '%q'
API String ID: 0-2319803734
Opcode ID: b38855238af2531ce60fd00ce09af3bab892eb1459e02d727cf440c0a4dbcd53
Instruction ID: 6a18ba9f29ae13597463d41330159f128b2e7906f099dd81b594b832638229c8
Opcode Fuzzy Hash: b38855238af2531ce60fd00ce09af3bab892eb1459e02d727cf440c0a4dbcd53
Instruction Fuzzy Hash: F161BF32F186558EEB20DBA5D4605BC3BB8BB48B68F540635DE2E67BE4DF38D4418740

Function 00007FF78689F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF78689FAEC
_get_daylight.LIBCMT ref: 00007FF78689FAFD
_get_daylight.LIBCMT ref: 00007FF78689FB0E
_isindst.LIBCMT ref: 00007FF78689FBD9

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 4094a66d5b99ca3d403801d18793965d5da29ac97c06b9f3adbb7227d4bb10b0
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 74510772F08111AAFB28EF249D556BEB7A1BB00358FB04135DE1E52AE4EB38BC51C710

Function 00007FFD93AAA019 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93AAA15D
memcpy.VCRUNTIME140 ref: 00007FFD93AAA176

Strings

string or blob too big, xrefs: 00007FFD93AAFC85
out of memory, xrefs: 00007FFD93AAFFBB

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: out of memory$string or blob too big
API String ID: 3510742995-2410398255
Opcode ID: c6fdc3985466bb38230f9addb8fe37f9a444154b41579b374f21e115db765590
Instruction ID: e4a85c3b369dfade460ea0b404af81f97a01fff1ce7c7c5548d2eb5ad8e21933
Opcode Fuzzy Hash: c6fdc3985466bb38230f9addb8fe37f9a444154b41579b374f21e115db765590
Instruction Fuzzy Hash: 0361D523B0879282E7348B56D45027EABA9FF45B88F114032EF8DA7B95DF3DE4019701

Function 00007FFD93A77EA7 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93A77F58
memcpy.VCRUNTIME140 ref: 00007FFD93A77FF4

Strings

(subquery-%u), xrefs: 00007FFD93A78016
(join-%u), xrefs: 00007FFD93A77FFF

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: (join-%u)$(subquery-%u)
API String ID: 3510742995-2916047017
Opcode ID: 2ad6d21d790f8b272c37a4ffbf55a8d7d0210876ad3007313e440fdfd4e477f8
Instruction ID: 339bc20631398bda2cf6cdaeaed7af49601e48ed28a6f759cf427961f5043002
Opcode Fuzzy Hash: 2ad6d21d790f8b272c37a4ffbf55a8d7d0210876ad3007313e440fdfd4e477f8
Instruction Fuzzy Hash: 4061DF32F0868985EB719B65D0A5BBA77ACFF547A8F440631DA6E132D4DF2DE842C700

Function 00007FFD93A89360 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93A89488

Strings

database corruption, xrefs: 00007FFD93A89552
%s at line %d of [%.10s], xrefs: 00007FFD93A8955E
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A89545

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 2221118986-3764764234
Opcode ID: 8f983514268cc7df1290e166eec0b47a294775388fb5c19de4c52b4ac99553b0
Instruction ID: ef2a57d0a5c658a89d37176b938cb40a5c0b61e8608b9e703586ababbfeb1cfd
Opcode Fuzzy Hash: 8f983514268cc7df1290e166eec0b47a294775388fb5c19de4c52b4ac99553b0
Instruction Fuzzy Hash: 33518E32B09B8287EB68CF66E5506AA73A9FB48B88F54403ADF4D53754DF38E455C300

Function 00007FFD93A97170 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93A972A2

Strings

database corruption, xrefs: 00007FFD93A97314
%s at line %d of [%.10s], xrefs: 00007FFD93A97320
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A97307

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 3510742995-3764764234
Opcode ID: 2a94730eed77a3b68ecc875e2f8e79a8d471dccbd3bbaaddc1aafe578b332632
Instruction ID: ac229d9effb52cb9e8c2575536aa3c5b45a0b6034a5fd49280dfdff4762d3d4a
Opcode Fuzzy Hash: 2a94730eed77a3b68ecc875e2f8e79a8d471dccbd3bbaaddc1aafe578b332632
Instruction Fuzzy Hash: DF519B32B18B81C6DB208F95F4502AAB7A9FB94B84F544022EE8D27B68CF3CD455C710

Function 00007FF7868957EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF78689581F
GetFileInformationByHandle.KERNEL32 ref: 00007FF786895881
GetLastError.KERNEL32 ref: 00007FF786895912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF786895724), ref: 00007FF78689595E

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: f99fc6d47d5cf4a6cbd26f2c241bfaaac3c51670f09e7bd9ec395e9a80d1c405
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 3451D262E186419AFB11EF71E8503BEA3B1BB44B58FA44435DE4D57688EF38E861C321

Function 00007FFD93A8B160 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFD93A8B236

Strings

database corruption, xrefs: 00007FFD93A8B2DD
%s at line %d of [%.10s], xrefs: 00007FFD93A8B2E9
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A8B2D0

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 2221118986-3764764234
Opcode ID: fa40007d604dc6cc06400549b7ec3b66cbe8079a186df2d3bd517a7d904fd4b9
Instruction ID: 9f42c2b279ce7271f00fb39803f4bdb5e147fdecf461595b17b7d61f9c5d9b9b
Opcode Fuzzy Hash: fa40007d604dc6cc06400549b7ec3b66cbe8079a186df2d3bd517a7d904fd4b9
Instruction Fuzzy Hash: C5418032B18B4583EB648F95E4606AD73A9FB84B90F540135EE8E67794EF3CD9418740

Function 00007FFD93A967E0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 83COMMON

Download Yara Rule

Strings

database corruption, xrefs: 00007FFD93A96844
%s at line %d of [%.10s], xrefs: 00007FFD93A96850
831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0, xrefs: 00007FFD93A96837

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$831d0fb2836b71c9bc51067c49fee4b8f18047814f2ff22d817d25195cf350b0$database corruption
API String ID: 0-3764764234
Opcode ID: e356b54525bc3db644c2bbfedda288c80d706b5e07cb6a97744b6204c7493019
Instruction ID: a6d78ee67193bcf24a383ec58f92ba5908867d1e98453792b3ea2ddfb873af49
Opcode Fuzzy Hash: e356b54525bc3db644c2bbfedda288c80d706b5e07cb6a97744b6204c7493019
Instruction Fuzzy Hash: 85312133B097C18ED714CF6AD0A007D3BA4EB44B98B04813AEF896B369DA3CD555C750

Function 00007FF78688D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF78688D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF78688D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF78688D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF78688D0D6

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: e33f877b0c3400c062c6459c327c8d0d4595e5f27f299ae574f67bd03c07446c
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 0B118822B14B069AEB00DF61EC442BA73B0FB08758F840E31DE2D82BA4DF38D4A4C350

Function 00007FFD93A72420 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

_localtime64_s.API-MS-WIN-CRT-TIME-L1-1-0(?), ref: 00007FFD93A72546

Strings

local time unavailable, xrefs: 00007FFD93A72553
3|r<, xrefs: 00007FFD93A7243A

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: _localtime64_s
String ID: 3|r<$local time unavailable
API String ID: 4067328638-127800857
Opcode ID: ecd40c4846240caddba8e1b915ab4266419b3d4c6786aa4430cfa7f29b80178f
Instruction ID: 884967eae394b5e2e154c8aa9e27bba6cd3489598d0d1e0d2d2f9eb46928f1f6
Opcode Fuzzy Hash: ecd40c4846240caddba8e1b915ab4266419b3d4c6786aa4430cfa7f29b80178f
Instruction Fuzzy Hash: DE51E162F14B458AE724CFB8D4A02AC23A4FB5879CF009335EA5E27B85DF38E191C700

Function 00007FF7868A5B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7868A17D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A1803

_get_daylight.LIBCMT ref: 00007FF7868A5CA4
_get_daylight.LIBCMT ref: 00007FF7868A5CB5

Strings

?, xrefs: 00007FF7868A5C35

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
Instruction ID: 2fe6aa5e1a9d07c4ecce242be6cab11595c49a2b9f472a5dca3283ade030baf5
Opcode Fuzzy Hash: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
Instruction Fuzzy Hash: 9A414C12A0828162FB25B716EC0137BD651FB90BA5FB44235EF5C06AD9DF3CD8A1C712

Function 00007FF786899084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868990B6

Part of subcall function 00007FF78689A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9CE
Part of subcall function 00007FF78689A9B8: GetLastError.KERNEL32(?,?,?,00007FF7868A2D92,?,?,?,00007FF7868A2DCF,?,?,00000000,00007FF7868A3295,?,?,?,00007FF7868A31C7), ref: 00007FF78689A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF78688CC15), ref: 00007FF7868990D4

Strings

C:\Users\user\Desktop\shost.exe, xrefs: 00007FF7868990C2

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\shost.exe
API String ID: 3580290477-2881294525
Opcode ID: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
Instruction ID: 99fd8187acac3632bc0b78e197cd58387b5a924de38d3d18f8efa98ec1ffb203
Opcode Fuzzy Hash: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
Instruction Fuzzy Hash: 98418131A08B02A5EB14BF259C910BEA3A4FB457D0FE94035E94D43B85EE3DECA1C320

Function 00007FF78689CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF78689CDBF
GetLastError.KERNEL32 ref: 00007FF78689CDE1

Strings

U, xrefs: 00007FF78689CD6B

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: 43713cf6f30144cee7e302d846f67f013f13b27f82fc671ba6bb74f00ef0e53d
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: BA41D632B18A8195DB60DF25E8443AAA760FB88794FA04031EE4D87B98EF3DE811C750

Function 00007FF78689F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF78689F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF78689F6BA

Strings

:, xrefs: 00007FF78689F67E

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
Instruction ID: 3571984de55b9c68e7de0bda7693d152d0459020119988b200e799a28f81430d
Opcode Fuzzy Hash: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
Instruction Fuzzy Hash: AD212522A0838192EB24AB15D80422FB3B1FB84B44FE14035CB8C43684EF7CED64CB61

Function 00007FF78688FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF78688FE08
RaiseException.KERNEL32 ref: 00007FF78688FE49

Strings

csm, xrefs: 00007FF78688FE36

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: 33334e2d54aa868b198f9f16b0290658234dcef9eb05bcdc3ca54d99c8bf4581
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: D3112132618B8192EB619F15F84026AB7E5FB88B84F684231EF8D07759DF3CD961C710

Function 00007FF7868A07AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7868A07DC
GetDriveTypeW.KERNEL32 ref: 00007FF7868A081C

Strings

:, xrefs: 00007FF7868A0805

Memory Dump Source

Source File: 00000002.00000002.3395985980.00007FF786881000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF786880000, based on PE: true

Associated: 00000002.00000002.3395970050.00007FF786880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396011085.00007FF7868AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396033229.00007FF7868C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.3396065976.00007FF7868C9000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff786880000_shost.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: 2eac4813aed6ac5e8bd0c3bc86fcd25e6d1e8c041b920415b1ce83ead92cfdec
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: C001712291820396F720BF61986527FA2A0FF44749FE40035D94D42691EE3DE924CA25

Function 00007FFD93BE4B18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FFD93BE4B68
PyUnicode_FromString.PYTHON312 ref: 00007FFD93BE4B85

Strings

no such name, xrefs: 00007FFD93BE4B5E

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: String$Err_FromUnicode_
String ID: no such name
API String ID: 3678473424-4211486178
Opcode ID: ac25febba8f5bdc0c9cfa2e9817e8debf067cef10677f4d15bb58f151aba3dd9
Instruction ID: 20f051094269603b35de090cc236e4c3d3c2ea2f6d9f6477a5026b85813e28cb
Opcode Fuzzy Hash: ac25febba8f5bdc0c9cfa2e9817e8debf067cef10677f4d15bb58f151aba3dd9
Instruction Fuzzy Hash: F7014475B1CA4281FB719BA9E8647B933A8BF9CB8CF440031DA8E66350DF2CE5048742

Function 00007FFD93A750B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFD93A750C8
_msize.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFD93A750D9

Strings

failed memory resize %u to %u bytes, xrefs: 00007FFD93A750E2

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: _msizerealloc
String ID: failed memory resize %u to %u bytes
API String ID: 2713192863-2134078882
Opcode ID: 92894b7a421d4a8d0f2dc1f799139c1eca998cb75613eb0b3fdb44dfe30869b9
Instruction ID: b9aab1121aab79be8d67652a02d4268a69bf8add38a342d8eec676a2a12687f5
Opcode Fuzzy Hash: 92894b7a421d4a8d0f2dc1f799139c1eca998cb75613eb0b3fdb44dfe30869b9
Instruction Fuzzy Hash: 4CE06D21F0978181FA248B96F9A44796265AF48FCCB185534EE4E2BB69EF2CE542C700

Function 00007FFD93BE25C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_PyObject_GC_New.PYTHON312(?,?,00000000,00007FFD93BE2533), ref: 00007FFD93BE25C6
PyObject_GC_Track.PYTHON312(?,?,00000000,00007FFD93BE2533), ref: 00007FFD93BE25F8

Strings

3.2.0, xrefs: 00007FFD93BE25D4

Memory Dump Source

Source File: 00000002.00000002.3396285508.00007FFD93BE1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FFD93BE0000, based on PE: true

Associated: 00000002.00000002.3396270036.00007FFD93BE0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93BE5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C42000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C8E000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C92000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93C97000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396302938.00007FFD93CEF000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396461517.00007FFD93CF2000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.3396477053.00007FFD93CF4000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93be0000_shost.jbxd

Similarity

API ID: Object_$Track
String ID: 3.2.0
API String ID: 16854473-1786766648
Opcode ID: f91d149df4c654f8be0df0ef2da4b36c9d06b56ee9d54162962ccaca08fa2000
Instruction ID: 69140cea3333abaf895be855210e886987ded63a92cd107d5cd9583d4e4830d2
Opcode Fuzzy Hash: f91d149df4c654f8be0df0ef2da4b36c9d06b56ee9d54162962ccaca08fa2000
Instruction Fuzzy Hash: 5AE0ED25B15B0695EB399B99E86406823ACEF08708B540136CD8D16310EF3CE164C3C2

Function 00007FFD93ABABE0 Relevance: 5.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FFD93AB532C), ref: 00007FFD93ABAD4A
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FFD93AB532C), ref: 00007FFD93ABAD75
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FFD93AB532C), ref: 00007FFD93ABAD91
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FFD93AB532C), ref: 00007FFD93ABADD6

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 063867daf08dc840c18da87f71504e9cfd181ef9bf5db64338ac6d78780bbdb1
Instruction ID: bd566f85adff7fde8421550ed58df23cdb488da7e3a83eb8ff754f3cc83fe86f
Opcode Fuzzy Hash: 063867daf08dc840c18da87f71504e9cfd181ef9bf5db64338ac6d78780bbdb1
Instruction Fuzzy Hash: A391D232B08A8286EB74CF96916076A77B8FB45BD4F048135EE9D57B85DF3CE4A08701

Function 00007FFD93ABB340 Relevance: 5.2, APIs: 4, Instructions: 220COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFD93ABB427
memcpy.VCRUNTIME140 ref: 00007FFD93ABB47B
memcpy.VCRUNTIME140 ref: 00007FFD93ABB4D7
memcpy.VCRUNTIME140 ref: 00007FFD93ABB55B

Memory Dump Source

Source File: 00000002.00000002.3396120486.00007FFD93A71000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FFD93A70000, based on PE: true

Associated: 00000002.00000002.3396103900.00007FFD93A70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396211118.00007FFD93B9E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396236464.00007FFD93BCB000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.3396252190.00007FFD93BD0000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd93a70000_shost.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 3f859ac6ac02e878cf440436bbbe9bcf4ba2bca3893d27bab73cb4c77d7d8bd1
Instruction ID: 1fc1e6c37cae2ca0872ff4858d8de8edc927743d72ded656e6fe5829cf3b8c57
Opcode Fuzzy Hash: 3f859ac6ac02e878cf440436bbbe9bcf4ba2bca3893d27bab73cb4c77d7d8bd1
Instruction Fuzzy Hash: D491BF32B097868AEA74DF5694A426A77E8FB44BE0F484234DE5E17BC1DF3CE4208700

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report shost.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_ARC4.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_Salsa20.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_chacha20.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_pkcs1_decode.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_aes.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_aesni.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_arc2.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_blowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cast.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cbc.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_cfb.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ctr.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_des.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_des3.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ecb.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_eksblowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ocb.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Cipher\_raw_ofb.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_BLAKE2b.pyd

C:\Users\user\AppData\Local\Temp\_MEI45762\Crypto\Hash\_BLAKE2s.pyd

Windows Analysis Report
shost.exe